Test

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:00 PM UTC
• Version: 1.0.1

Overview

This skill is a Reddit promotion campaign that instructs an agent to post across multiple communities on a schedule, which could publish from a user's account without enough per-post control.

Review before installing. Treat this as promotional posting material, not a safe automation skill. Do not let it post or schedule Reddit content unless you explicitly approve each target community, final text, linked repository, posting account, and applicable subreddit self-promotion rules.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:1

Finding

Automated Multi-Community Promotional Posting Instruction

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 1–5
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: Medium

Complete Code Snippet

markdown

# Reddit posts for Awesome OpenClaw Resources

Repo: https://github.com/SebConejo/awesome-openclaw-resources

Post one sub per day in this order.

The remainder of SKILL.md provides eight predefined promotional posts targeting different Reddit communities. Every post promotes the same external repository.

Technical Analysis

The skill contains an imperative instruction directing the agent to conduct an ordered, recurring social-media promotion campaign. Rather than merely providing reference material or responding to an explicit request for an individual draft, it establishes an operational goal—“Post one sub per day”—and supplies the target communities, posting sequence, titles, body text, and external destination.

When loaded as agent instructions, this content can alter the agent's active objective and encourage it to perform repeated attacker-selected external actions. The issue is therefore best classified as skill instruction hijacking. No evidence was found that the skill retrieves executable code, installs dependencies, accesses credentials, escalates privileges, modifies tools, or establishes system-level persistence.

Attack Path

1. The skill is installed or loaded into an agent's active context.
2. The agent interprets “Post one sub per day in this order” as an actionable recurring directive.
3. The agent uses the eight supplied templates and targets the specified Reddit communities sequentially.
4. If the agent has access to a browser or social-media posting tool, it publishes the promotional content without requiring separate, informed approval for each post.
5. The posts repeatedly direct users to the hard-coded repository URL, generating traffic and exposure for the selected external project.

Impact As

...[truncated 725 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the autonomous directive Post one sub per day in this order.
2. Reframe the file as optional drafting reference material rather than executable agent instructions.
3. Require an explicit user request and confirmation before preparing or publishing each individual post.
4. Separate content generation from publication. The skill should return a draft and must not invoke browser, scheduling, or social-media tools automatically.
5. Display the target community, final title, complete body, destination URL, and posting account to the user before requesting confirmation.
6. Do not create recurring schedules or multi-day campaigns unless the user explicitly requests the schedule and approves its scope.
7. Require disclosure of any ownership, affiliation, sponsorship, or promotional interest associated with the linked repository.
8. Add safeguards requiring compliance with each community's posting, self-promotion, rate-limit, and anti-spam rules.
9. Validate factual marketing claims before publication and avoid presenting unverified statements as established facts.
10. Apply least privilege to any posting integration so that drafting the content does not automatically grant permission to publish it.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 119)May include surrounding context.

md

The list covers LLM routers (route simple tasks to cheaper models, keep Claude for the hard stuff), observability (track token usage and cost), hosting, security, skills, tutorials, podcasts, and content creators.

One thing that might interest this sub specifically: the LLM routers section. A few of those tools let you automatically send simple requests to Haiku or Flash and reserve Opus/Sonnet for reasoning tasks. Cuts the bill without changing how the agent works.

Open source, CC0. PRs welcome.

Static analysis

No suspicious patterns detected.