ClawHub
Back to skill

Security audit

Threads Publisher

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Threads publishing helper, but it relies on a third-party token-bearing connector with broad social publishing authority and gives underspecified local-file upload instructions.

Review this before installing if the connected Boring account has multiple social accounts or brand accounts. Treat the MCP URL as a password, connect only the accounts you intend to let the agent post from, verify the target account and content before each publish or schedule action, and only upload explicit media files you selected for the post.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:7
Finding

Third-Party Connector Receives Broad Social-Media Publishing Authority

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 7-29
Vulnerability Type: Excessive third-party connector privileges
Risk Level: High

Vulnerable Code

markdown
metadata:
  openclaw:
    emoji: "🧵"
    homepage: https://boring-doc.aiagent-me.com/getting-started/mcp.html
    requires:
      config:
        - MCP Connector link from boring.aiagent-me.com (contains embedded auth token)
---

# Boring Threads Publisher

Publish posts, multi-post threads, and replies on Threads. Powered by [Boring](https://boring-doc.aiagent-me.com).

## Security & Data Handling

- **MCP link is a credential**: Your MCP Server URL (`https://boring.aiagent-me.com/mcp/t/xxxxx...`) contains an embedded authentication token. Treat it like a password — do not share it publicly.
- **Token scope**: The embedded token grants **publish access** to your connected social media accounts. It can create posts, upload media, and manage scheduled posts on the platforms you have connected. It cannot access your social media passwords or modify account settings.
- **Token storage**: The token is stored server-side in Boring's database (MongoDB on DigitalOcean). It is never written to your local filesystem. You can regenerate or revoke it anytime at [boring.aiagent-me.com/settings](https://boring.aiagent-me.com/settings).
- **Data flow**: Analytics queries are sent from Boring's server (Google Cloud, us-central1) to the platform's API on your behalf. Only performance metrics are retrieved — no content is uploaded or modified.
- **No local credentials**: No local API keys, environment variables, or secrets are needed. All auth is embedded in the MCP link.
- **Third-party service**: This skill relies on [Boring](https://boring.aiagent-me.com), an open-source social media management tool. Source code: [github.com/snoopyrain](https://github.com/snoopyrain).

Technical Analysis

The skill requires the user to install a bea ...[truncated 2279 chars]

Remediation
View remediation

Remediation Suggestions

  1. Issue a separate token for each platform and account rather than exposing every connected account through one connector.
  2. Restrict OAuth and connector permissions to the minimum operations required for Threads publishing.
  3. Separate immediate publishing, replies, media upload, and scheduled-post management into independently granted scopes.
  4. Require explicit user confirmation immediately before every publish, reply, upload, scheduling, rescheduling, or deletion operation.
  5. Display the target platform, account, content preview, media list, and scheduled time in the confirmation prompt.
  6. Use short-lived, revocable credentials and rotate them after suspected disclosure.
  7. Avoid placing reusable bearer credentials directly in URLs. Prefer secret headers or a managed credential store that redacts values from logs and user-visible output.
  8. Add account-level allowlists, audit logs, anomaly detection, rate limits, and notifications for publishing activity.
  9. Document exactly which remote operations the connector exposes and how users can immediately revoke access.
  10. Provide version-pinned, auditable source code for the deployed MCP server or an integrity-verifiable self-hosted option.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:92
Finding

Local-File Upload Guidance Lacks Path and Sensitive-Data Restrictions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 92-95
Vulnerability Type: Unrestricted local-file transmission to a third-party service
Risk Level: Medium

Vulnerable Code

markdown
### Step 5: Prepare Media

- **Local files**: `boring_upload_file` with `file_path`
- **URLs**: `boring_upload_from_url` to re-host

Technical Analysis

The skill instructs the agent to submit a local file_path to a third-party upload tool without defining an allowed directory, requiring user selection, validating the resolved path, or checking whether the file contains credentials or other sensitive information.

The instructions also omit extension, MIME-type, symbolic-link, file-size, and destination validation. If the tool accepts arbitrary readable paths, an agent influenced by malicious or misleading content could attempt to upload files unrelated to the requested social-media post. Symbolic links or path traversal could further bypass superficial directory checks if the remote tool or agent runtime does not canonicalize paths.

Because the implementation of boring_upload_file is not present in the audited artifact, the tool's internal safeguards cannot be verified. The issue is therefore the skill's failure to require safe handling before invoking a data-egress operation.

Attack Path

  1. The agent receives a publishing request containing an attacker-controlled or misleading local file path.
  2. The path identifies a readable sensitive file, or a symbolic link resolves from an apparently valid media location to such a file.
  3. Following the documented workflow, the agent calls boring_upload_file with that path.
  4. The file is transmitted from the local environment to the external service.
  5. The service stores, processes, or re-hosts the uploaded data, exposing it outside the original trust boundary.

Exploitation requires the agent or upload tool to have read access to the targeted file. The ...[truncated 665 chars]

Remediation
View remediation

Remediation Suggestions

  1. Permit uploads only from explicit user-selected media files or a dedicated, access-controlled upload directory.
  2. Canonicalize each path and verify that the resolved target remains inside the approved directory.
  3. Reject symbolic links, path traversal, device files, sockets, hidden files, and known credential or configuration paths.
  4. Allowlist expected media extensions and verify actual MIME type and file signatures rather than trusting the filename.
  5. Enforce documented image and video size limits before transmitting data.
  6. Scan selected files for secrets and sensitive metadata where practical.
  7. Present the canonical local path, file size, media type, destination service, and target social account to the user.
  8. Require explicit confirmation immediately before every external file upload.
  9. Ensure that uploaded objects are private by default, have limited retention, and are deleted after publishing when no longer required.
  10. Run the connector with filesystem sandboxing so it cannot read files outside the dedicated media directory.

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The manifest description presents this skill as being for publishing posts, threads, and replies on Threads. However, the security/data-handling section states the token can 'manage scheduled posts' and that 'analytics queries are sent' to platform APIs, which are distinct capabilities not reflected in the stated skill purpose.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.