ClawHub
Back to skill

Security audit

TikTok Skill

Security checks for vulnerabilities and agentic risk

Overview

This TikTok posting skill needs review because its file handling can overwrite unrelated files and its fallback login method can expose an API key.

Prefer OAuth and avoid placing API keys in URLs. Until file handling is hardened, use self-created plans inside a sandbox without access to unrelated files, and keep backups of originals. Review the full HTML preview, account, privacy and schedule before approving publication. Selected media is uploaded to WoopSocial and its storage provider. The Review verdict rests on verified file-handling and credential concerns, not the scanner's critical rating.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (32)

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
88% confidence
Finding

The TikTok rendering functionality matches the declared photo-post preparation purpose. However, the default output formats include Instagram, producing 1080×1350 images and an Instagram contact sheet unless --no-instagram is supplied. This is an additional, undeclared cross-platform capability. Font downloading and optional face-overlap detection are supporting implementation details, not separate mismatches. The supplied chunk does not implement publishing, scheduling, or analytics, but their absence from this rendering component alone does not establish a skill-wide mismatch.

Content

No source excerpt is available for this finding.

Incomplete referenced artifact analysis

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 123)May include surrounding context.

md
python3 scripts/tt_check.py plan.json --fix # 9:16, H.264/AAC, constant fps

Incomplete referenced artifact analysis

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 152)May include surrounding context.

md
posts `"source": "third_party"` in the plan so `tt_check.py` can warn.

Incomplete referenced artifact analysis

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 183)May include surrounding context.

md
python3 scripts/tt_check.py plan.json # report

Incomplete referenced artifact analysis

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 184)May include surrounding context.

md
python3 scripts/tt_check.py plan.json --fix # fixed copies in fixed/, plan updated, originals kept

Context Leakage

High
Category
Data Exfiltration
Confidence
85% confidence
Finding

Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Content

Scanner excerpt · scripts/upload_parts.py (reported line 2)May include surrounding context.

python
#!/usr/bin/env python3
"""Upload one file to a WoopSocial media upload session (standard library only).

WoopSocial uploads work in three steps:
  1. The agent calls `media_uploads_create_session` with the projectId and the file size in bytes.

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: file_write, mcp, network, shell.

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/woopsocial.md (reported line 28)May include surrounding context.

md
|---|---|
| Claude (claude.ai, Desktop, Cowork) | Add WoopSocial from the [Claude directory](https://claude.ai/directory/woopsocial), click Connect and sign in |
| Cursor | Install from [cursor.directory](https://cursor.directory/plugins/woopsocial-social-media-scheduler) and sign in |
| Claude Code | `claude mcp add --transport http woopsocial "https://api.woopsocial.com/mcp"`, then restart with `claude --continue` (keeps the conversation), `/mcp`, select woopsocial, Authenticate |
| Codex | `codex mcp add woopsocial --url https://api.woopsocial.com/mcp`, then `codex mcp login woopsocial`, then start a new session (`codex resume --last` keeps this one) |
| OpenClaw | Install the [WoopSocial skill on ClawHub](https://clawhub.ai/woopsocial/skills/social-media-scheduler), or add the MCP URL to the agent's MCP config |
| Agents without sign-in support | Create an API key at [app.woopsocial.com/api-access](https://app.woopsocial.com/api-access) and use `https://api.woopsocial.com/mcp?api_k=

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/woopsocial.md (reported line 29)May include surrounding context.

md
(claude.ai, Desktop, Cowork) | Add WoopSocial from the [Claude directory](https://claude.ai/directory/woopsocial), click Connect and sign in |
| Cursor | Install from [cursor.directory](https://cursor.directory/plugins/woopsocial-social-media-scheduler) and sign in |
| Claude Code | `claude mcp add --transport http woopsocial "https://api.woopsocial.com/mcp"`, then restart with `claude --continue` (keeps the conversation), `/mcp`, select woopsocial, Authenticate |
| Codex | `codex mcp add woopsocial --url https://api.woopsocial.com/mcp`, then `codex mcp login woopsocial`, then start a new session (`codex resume --last` keeps this one) |
| OpenClaw | Install the [WoopSocial skill on ClawHub](https://clawhub.ai/woopsocial/skills/social-media-scheduler), or add the MCP URL to the agent's MCP config |
| Agents without sign-in support | Create an API key at [app.woopsocial.com/api-access](https://app.woopsocial.com/api-access) and use `https://api.woopsocial.com/mcp?api_key=%2A%2A%2A |

External Transmission

Medium
Category
Data Exfiltration
Confidence
96% confidence
Finding

The fallback instructs users to place an API key in the MCP URL query string. Such URLs can persist in agent configuration, diagnostic output, and proxy or server access logs, exposing a credential that may authorize social-account operations; HTTPS does not prevent these endpoint-side leaks.

Content

Scanner excerpt · references/woopsocial.md (reported line 31)May include surrounding context.

md
| Claude Code | `claude mcp add --transport http woopsocial "https://api.woopsocial.com/mcp"`, then restart with `claude --continue` (keeps the conversation), `/mcp`, select woopsocial, Authenticate |
| Codex | `codex mcp add woopsocial --url https://api.woopsocial.com/mcp`, then `codex mcp login woopsocial`, then start a new session (`codex resume --last` keeps this one) |
| OpenClaw | Install the [WoopSocial skill on ClawHub](https://clawhub.ai/woopsocial/skills/social-media-scheduler), or add the MCP URL to the agent's MCP config |
| Agents without sign-in support | Create an API key at [app.woopsocial.com/api-access](https://app.woopsocial.com/api-access) and use `https://api.woopsocial.com/mcp?api_key=%2A%2A%2A |

The API key is a password: never paste it into shared chats or commit it.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/woopsocial.md (reported line 40)May include surrounding context.

md
returns a link; the user opens it, approves, and tells you when they're done. Confirm with
`social_accounts_list`. Repeat per platform.

Find IDs yourself with `projects_list` and `social_accounts_list`; never ask the user to paste
IDs.

## 3. Read each account's limits

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/check_setup.py (reported line 12)May include surrounding context.

python
system = platform.system()
INSTALL_FFMPEG = {"Darwin": "brew install ffmpeg", "Windows": "winget install ffmpeg",
                  "Linux": "sudo apt install ffmpeg   (or your distro's package manager)"}.get(system, "install ffmpeg")
PIP = "py -m pip" if system == "Windows" else "python3 -m pip"
ok = True

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/check_setup.py (reported line 40)May include surrounding context.

python
line("missing", "Pillow", f"{PIP} install pillow")

if shutil.which("ffmpeg") and shutil.which("ffprobe"):
    v = subprocess.run(["ffmpeg", "-version"], capture_output=True, text=True).stdout.split("\n")[0]
    line("ok", "ffmpeg", v.replace("ffmpeg version ", "")[:60])
else:
    line("needed for video", "ffmpeg", f"{INSTALL_FFMPEG}  (photo posts work without it)")

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/log.py (reported line 52)May include surrounding context.

python
return None
    path = m if os.path.isabs(m) else os.path.join(base, m)
    try:
        out = subprocess.run(["ffprobe", "-v", "error", "-show_entries", "format=duration", "-of", "csv=p=0", path],
                             capture_output=True, text=True).stdout.strip()
        return round(float(out), 2)
    except Exception:

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/preview.py (reported line 41)May include surrounding context.

python
if is_video(src):
        img = Image.new("RGB", (540, 960), "#222")
        if shutil.which("ffmpeg"):
            subprocess.run(["ffmpeg", "-y", "-v", "error", "-ss", str(at), "-i", src, "-frames:v", "1",
                            "-vf", "scale=540:960:force_original_aspect_ratio=increase,crop=540:960", dst], capture_output=True)
            if os.path.exists(dst):
                img = Image.open(dst).convert("RGB")

The agent-facing PNG omits the required posting settings despite documentation claiming it contains the same preview as the HTML.

Medium
Category
Excessive Agency
Confidence
98% confidence
Finding

The PNG contains only feed cards and labels, whereas privacy, interaction permissions, disclosures, and consent text are rendered exclusively into HTML despite the documentation describing equivalent previews. An agent relying on its image review can therefore miss security-relevant posting settings; the separate required HTML review reduces the risk but does not fix the misleading verification artifact.

Content

No source excerpt is available for this finding.

The renderer claims to be local but automatically downloads a missing font.

Medium
Category
Excessive Agency
Confidence
99% confidence
Finding

The supposedly local renderer automatically downloads a font from a mutable main-branch URL and checks only its minimum size before loading it through Pillow/FreeType. This introduces an undisclosed network dependency and an unverified external parsing input; compromising the upstream asset could disrupt rendering or exploit a vulnerable font parser, though neither compromise nor such a parser vulnerability is demonstrated here.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/render_slides.py (reported line 120)May include surrounding context.

python
except Exception:
        # Python builds without system certificates (common on macOS): use curl instead.
        try:
            subprocess.run(["curl", "-fsSL", "-o", BUNDLED_FONT, FONT_URL], check=True, timeout=60)
        except Exception:
            return False
    if not os.path.exists(BUNDLED_FONT) or os.path.getsize(BUNDLED_FONT) < 100000:

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/tt_check.py (reported line 61)May include surrounding context.

python
def probe_video(path):
    if not shutil.which("ffprobe"):
        sys.exit("ffprobe not found: install ffmpeg to check videos (see scripts/check_setup.py)")
    out = subprocess.run(["ffprobe", "-v", "error", "-show_format", "-show_streams", "-of", "json", path],
                         capture_output=True, text=True)
    if out.returncode != 0:
        return None

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
95% confidence
Finding

There is no shell injection, but the command uses -y to overwrite the predictable path src + '.edge.png', then deletes that path after reading it. A pre-existing adjacent image can therefore be overwritten and removed during a legitimate fix operation, and a planted symlink can redirect the write to another writable file.

Content

Scanner excerpt · scripts/tt_check.py (reported line 167)May include surrounding context.

python
def edge_colour(src):
    """The average colour of the video's top and bottom edges, so the plate blends into it."""
    tmp = src + ".edge.png"
    subprocess.run(["ffmpeg", "-y", "-v", "error", "-ss", "1", "-i", src, "-frames:v", "1", "-vf", "scale=64:-2", tmp],
                   capture_output=True)
    try:
        with Image.open(tmp) as im:

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
97% confidence
Finding

The framed-video branch shares the unsafe output-path construction: plan-controlled post IDs and account names can introduce traversal or absolute paths into dst. With --fix enabled, the script can write both the derived plate image and the ffmpeg output outside fixed/, potentially overwriting writable files despite the promise that fixes preserve originals.

Content

Scanner excerpt · scripts/tt_check.py (reported line 235)May include surrounding context.

python
"-crf", "19", "-maxrate", "20M", "-bufsize", "40M", "-color_primaries", "bt709", "-color_trc", "bt709",
               "-colorspace", "bt709", "-c:a", "aac", "-b:a", "192k", "-ar", "48000", "-ac", "2",
               "-movflags", "+faststart", dst]
        r = subprocess.run(cmd, capture_output=True, text=True)
        os.remove(plate)
        if r.returncode != 0:
            raise RuntimeError(r.stderr.strip().splitlines()[-1] if r.stderr.strip() else "ffmpeg failed")

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
97% confidence
Finding

Although the subprocess uses no shell, its output destination incorporates an unvalidated post ID and potentially an account name from the plan. A post ID such as '../victim' escapes fixed/ and, when --fix processes media requiring repair, ffmpeg's -y can overwrite a writable victim-01.mp4 outside the intended output directory.

Content

Scanner excerpt · scripts/tt_check.py (reported line 254)May include surrounding context.

python
"-maxrate", "20M", "-bufsize", "40M", "-color_primaries", "bt709", "-color_trc", "bt709",
           "-colorspace", "bt709", "-c:a", "aac", "-b:a", "192k", "-ar", "48000", "-ac", "2",
           "-movflags", "+faststart", dst]
    r = subprocess.run(cmd, capture_output=True, text=True)
    if r.returncode != 0:
        raise RuntimeError(r.stderr.strip().splitlines()[-1] if r.stderr.strip() else "ffmpeg failed")
    return dst

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/tt_check.py (reported line 274)May include surrounding context.

python
def has_zscale():
    global _zs
    if _zs is None:
        out = subprocess.run(["ffmpeg", "-hide_banner", "-filters"], capture_output=True, text=True).stdout
        _zs = " zscale " in out
    return _zs

The script silently writes or overwrites check.json even in the documented report-only mode.

Medium
Category
Output Handling
Confidence
96% confidence
Finding

The documented report-only mode unconditionally opens check.json for writing, truncating an existing file without confirmation. In an attacker-controlled plan directory, a check.json symlink could redirect that write to another file accessible to the agent, turning validation into an unexpected destructive operation.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/upload_parts.py (reported line 28)May include surrounding context.

python
def put_with_curl(url, chunk):
    """Fallback for Python builds without system certificates (common on macOS)."""
    result = subprocess.run(
        ["curl", "-fsS", "-X", "PUT", "-H", "Content-Type: application/octet-stream",
         "--data-binary", "@-", "-o", os.devnull, "-w", "%{http_code}", url],
        input=chunk, capture_output=True, timeout=300)