ClawHub
Back to skill

Security audit

Publora

Security checks for vulnerabilities and agentic risk

Overview

This Publora skill is coherent and not deceptive, but it gives an agent broad public-posting, deletion, webhook, and workspace-management abilities without enough guardrails or clear defaults.

Review before installing. Use this only with a Publora API key you intend the agent to use, and require explicit user approval before publishing, bulk scheduling, deleting posts or reactions, creating webhooks, generating API keys, or acting on behalf of workspace users. Clarify the draft-versus-immediate-publish behavior before relying on the skill for real accounts.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (38)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

The skill includes a high-impact destructive endpoint that deletes posts and associated media, but it provides no guardrails around parameter validation or user confirmation. In an agent context, a malformed, spoofed, or loosely inferred postGroupId could trigger irreversible deletion of content and stored assets.

Content

Scanner excerpt · SKILL.md (reported line 125)May include surrounding context.

GET /api/v1/get-post/:postGroupId

Delete post (also removes media from storage)

DELETE /api/v1/delete-post/:postGroupId

text

## Get Post Logs

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

The delete-reaction endpoint is a state-changing destructive action exposed without any confirmation or parameter-safety guidance. While lower impact than deleting posts, an agent could still remove reactions unintentionally if it infers targets from ambiguous input or mixes resource identifiers.

Content

Scanner excerpt · SKILL.md (reported line 260)May include surrounding context.

md
| `POST /linkedin-followers` | Follower count and growth |
| `POST /linkedin-profile-summary` | Combined profile overview |
| `POST /linkedin-create-reaction` | React to a post |
| `DELETE /linkedin-delete-reaction` | Remove a reaction |

## Webhooks

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill trigger description is broad enough to match many high-impact actions, including posting, scheduling, user management, and webhook configuration, without clear gating conditions. In an agent setting, this increases the chance of the skill being invoked for sensitive operations without sufficiently explicit user intent or confirmation.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md
# Publora API — Core Skill

Publora is an affordable REST API for scheduling and publishing social media posts
across 10 platforms (Pinterest is listed internally but not yet supported). Base URL: `https://api.publora.com/api/v1`

## Plans & API Access

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

md
# Publora API — Core Skill

Publora is an affordable REST API for scheduling and publishing social media posts
across 10 platforms (Pinterest is listed internally but not yet supported). Base URL: `https://api.publora.com/api/v1`

## Plans & API Access

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

md
# Publora API — Core Skill

Publora is an affordable REST API for scheduling and publishing social media posts
across 10 platforms (Pinterest is listed internally but not yet supported). Base URL: `https://api.publora.com/api/v1`

## Plans & API Access

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

md
# Publora API — Core Skill

Publora is an affordable REST API for scheduling and publishing social media posts
across 10 platforms (Pinterest is listed internally but not yet supported). Base URL: `https://api.publora.com/api/v1`

## Plans & API Access

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.

md
# Publora API — Core Skill

Publora is an affordable REST API for scheduling and publishing social media posts
across 10 platforms (Pinterest is listed internally but not yet supported). Base URL: `https://api.publora.com/api/v1`

## Plans & API Access

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.

md
# Publora API — Core Skill

Publora is an affordable REST API for scheduling and publishing social media posts
across 10 platforms (Pinterest is listed internally but not yet supported). Base URL: `https://api.publora.com/api/v1`

## Plans & API Access

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.

md
# Publora API — Core Skill

Publora is an affordable REST API for scheduling and publishing social media posts
across 10 platforms (Pinterest is listed internally but not yet supported). Base URL: `https://api.publora.com/api/v1`

## Plans & API Access

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 134)May include surrounding context.

md
# Publora API — Core Skill

Publora is an affordable REST API for scheduling and publishing social media posts
across 10 platforms (Pinterest is listed internally but not yet supported). Base URL: `https://api.publora.com/api/v1`

## Plans & API Access

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 146)May include surrounding context.

md
# Publora API — Core Skill

Publora is an affordable REST API for scheduling and publishing social media posts
across 10 platforms (Pinterest is listed internally but not yet supported). Base URL: `https://api.publora.com/api/v1`

## Plans & API Access

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 165)May include surrounding context.

md
# Publora API — Core Skill

Publora is an affordable REST API for scheduling and publishing social media posts
across 10 platforms (Pinterest is listed internally but not yet supported). Base URL: `https://api.publora.com/api/v1`

## Plans & API Access

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 186)May include surrounding context.

md
# Publora API — Core Skill

Publora is an affordable REST API for scheduling and publishing social media posts
across 10 platforms (Pinterest is listed internally but not yet supported). Base URL: `https://api.publora.com/api/v1`

## Plans & API Access

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 194)May include surrounding context.

md
# Publora API — Core Skill

Publora is an affordable REST API for scheduling and publishing social media posts
across 10 platforms (Pinterest is listed internally but not yet supported). Base URL: `https://api.publora.com/api/v1`

## Plans & API Access

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 231)May include surrounding context.

md
# Publora API — Core Skill

Publora is an affordable REST API for scheduling and publishing social media posts
across 10 platforms (Pinterest is listed internally but not yet supported). Base URL: `https://api.publora.com/api/v1`

## Plans & API Access

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 244)May include surrounding context.

md
# Publora API — Core Skill

Publora is an affordable REST API for scheduling and publishing social media posts
across 10 platforms (Pinterest is listed internally but not yet supported). Base URL: `https://api.publora.com/api/v1`

## Plans & API Access

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 268)May include surrounding context.

md
# Publora API — Core Skill

Publora is an affordable REST API for scheduling and publishing social media posts
across 10 platforms (Pinterest is listed internally but not yet supported). Base URL: `https://api.publora.com/api/v1`

## Plans & API Access

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 299)May include surrounding context.

md
# Publora API — Core Skill

Publora is an affordable REST API for scheduling and publishing social media posts
across 10 platforms (Pinterest is listed internally but not yet supported). Base URL: `https://api.publora.com/api/v1`

## Plans & API Access

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 308)May include surrounding context.

md
# Publora API — Core Skill

Publora is an affordable REST API for scheduling and publishing social media posts
across 10 platforms (Pinterest is listed internally but not yet supported). Base URL: `https://api.publora.com/api/v1`

## Plans & API Access

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 313)May include surrounding context.

md
# Publora API — Core Skill

Publora is an affordable REST API for scheduling and publishing social media posts
across 10 platforms (Pinterest is listed internally but not yet supported). Base URL: `https://api.publora.com/api/v1`

## Plans & API Access

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

Omit scheduledTime to publish right away:

javascript
await fetch('https://api.publora.com/api/v1/create-post', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json', 'x-publora-key': 'sk_YOUR_KEY' },
  body: JSON.stringify({

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.

Omit scheduledTime to publish right away:

javascript
await fetch('https://api.publora.com/api/v1/create-post', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json', 'x-publora-key': 'sk_YOUR_KEY' },
  body: JSON.stringify({

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 313)May include surrounding context.

Omit scheduledTime to publish right away:

javascript
await fetch('https://api.publora.com/api/v1/create-post', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json', 'x-publora-key': 'sk_YOUR_KEY' },
  body: JSON.stringify({

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The documentation states both that omitting scheduledTime publishes immediately and that omitting it creates a draft, which is a dangerous ambiguity for a posting tool. In this context, a user or agent could unintentionally publish content that was meant to remain a draft, causing unauthorized or premature outbound communications.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.