ClawHub
Back to skill

Security audit

postflight

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent X-posting workflow, but it should be reviewed because it can publish publicly and has concrete local file-handling weaknesses around temporary files and photo ingestion.

Install only if you are comfortable granting the skill controlled access to your X posting workflow and local postflight-state data. Review the temp-file and photo-library path handling before using photo ingestion or concurrent runs, and keep X credentials/session setup under your direct control.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
PUBLISH-API.md:68
Finding

Predictable Shared Temporary Files Permit Symlink Attacks and Cross-Session Data Corruption

Content
View full analysis
"${TMPDIR:-/tmp}/upload.out" MEDIA_ID="$(jq -Rrs '[split("\n")[] | fromjson? | .data.id? // empty] | last // empty' \ < "${TMPDIR:-/tmp}/upload.out")" ``` Fallback processing uses the same predictable file: ```sh MEDIA_ID="$(grep -oE '"id"[[:space:]]*:[[:space:]]*"[0-9]+"' "${TMPDIR:-/tmp}/upload.out" \ | head -1 | grep -oE '[0-9]+')" ``` `PUBLISH-API.md:100-113`: ```sh cat > "${TMPDIR:-/tmp}/draft.txt" <<'XPOSTER_EOF_3f9c1a' XPOSTER_EOF_3f9c1a BODY="$(jq -Rsc '{text: rtrimstr("\n")}' < "${TMPDIR:-/tmp}/draft.txt")" xurl -X POST /2/tweets -d "$BODY" ``` The media variant also reads from the same fixed path: ```sh BODY="$(jq -Rsc --arg mid "$MEDIA_ID" \ '{text: rtrimstr("\n"), media: {media_ids: [$mid]}}' < "${TMPDIR:-/tmp}/draft.txt")" xurl -X POST /2/tweets -d "$BODY" ``` `PUBLISH-API.md:134-153`: ```sh cat > "${TMPDIR:-/tmp}/reply.txt" <<'XPOSTER_EOF_3f9c1a' XPOSTER_EOF_3f9c1a RBODY="$(jq -Rsc --arg tid "$TWEET_ID" \ '{text: rtrimstr("\n"), reply: {in_reply_to_tweet_id: $tid}}' < "${TMPDIR:-/tmp}/reply.txt")" xurl -X POST /2/tweets -d "$RBODY" ``` ```text Return the permalink(s) and delete the temp files (`draft.txt`, `reply.txt`, `upload.out`). ``` `DRAFTING.md:80-83`: ```sh cat > "${TMPDIR:-/tmp}/draft.txt" <<'XPOSTER_EOF_3f9c1a' XPOSTER_EOF_3f9c1a ``` `PHOTO-INGESTION.md:66-72`: ```sh {baseDir}/ingest-photo.sh --dir "$PWD/postflight-state/" \ --note-file "${TMPDIR:-/tmp}/note.txt" \ --location-file "${TMPDIR:-/tmp}/loc.txt" \ --name --taken \ " ...[truncated 2853 chars]
Remediation
View remediation
` reference with the corresponding unique path. 4. Keep `umask 077` active before creating files containing draft text, locations, notes, API responses, or media identifiers. 5. Ensure cleanup runs on both success and failure through an `EXIT` trap rather than relying on the final workflow step. 6. Do not reuse one temporary directory between concurrent drafting, ingestion, or publishing turns. 7. Where practical, create outputs atomically and reject symbolic links. For script implementations, use safe file descriptors or no-follow/exclusive creation semantics supported by the host platform. 8. Keep the existing quoted heredoc and JSON construction safeguards; they address a different command-injection risk and should remain in place. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
ingest-photo.sh:65
Finding

Photo Ingestion Does Not Enforce Destination Containment

Content
View full analysis
&1)"; then rm -f "$dir/$dest" die "exiftool could not rewrite $base (${strip_out##*$'\n'}) — not adding it" fi # The verify must fail closed: an exiftool error here is NOT a clean scan. if ! gps="$(exiftool -s3 -gps:all -XMP:Location -IPTC:Sub-location -City "$dir/$dest" 2>&1)"; then rm -f "$dir/$dest" die "could not verify the metadata strip ($gps) — not adding the photo" fi if [[ -n "$gps" ]]; then rm -f "$dir/$dest" die "location metadata survived the strip — not adding the photo" fi ok "EXIF stripped, filed as $dest" tag_list="" for t in "${tags[@]}"; do tag_list="${tag_list:+$tag_list, }\"$t\"" done manifest="$dir/manifest.yaml" if [[ ! -f "$manifest" ]]; then printf '# postflight photo library — one entry per postable photo.\n' > "$manifest" printf '# Maintained by ingest-photo.sh and your editor; the skill only reads it.\n' >> "$manifest" fi { printf -- '- file: %s\n' "$dest" printf ' ta ...[truncated 3506 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (13)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.

md
`pillars.example.md`, `ingest-photo.sh`. It is **read-only for you.** Never

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 216)May include surrounding context.

md
`pillars.example.md`, `ingest-photo.sh`. It is **read-only for you.** Never

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 223)May include surrounding context.

md
`pillars.example.md`, `ingest-photo.sh`. It is **read-only for you.** Never

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
80% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.

md
`pillars.example.md`, `ingest-photo.sh`. It is **read-only for you.** Never
create, edit, move, or delete anything inside it, for any reason. An
installer replaces this folder wholesale on every upgrade, so anything
written here is deleted without warning. It is not reachable relatively
either — spell it out in full every time (`cat {baseDir}/VOICE.md`).

**`postflight-state/` holds everything else**: settings, the post log,

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
80% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SKILL.md (reported line 218)May include surrounding context.

md
`pillars.example.md`, `ingest-photo.sh`. It is **read-only for you.** Never
create, edit, move, or delete anything inside it, for any reason. An
installer replaces this folder wholesale on every upgrade, so anything
written here is deleted without warning. It is not reachable relatively
either — spell it out in full every time (`cat {baseDir}/VOICE.md`).

**`postflight-state/` holds everything else**: settings, the post log,

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · ingest-photo.sh (reported line 142)May include surrounding context.

sh
cp "$photo" "$dir/$dest"
if ! strip_out="$(exiftool -all= -overwrite_original "$dir/$dest" 2>&1)"; then
  rm -f "$dir/$dest"
  die "exiftool could not rewrite $base (${strip_out##*$'\n'}) — not adding it"
fi
# The verify must fail closed: an exiftool error here is NOT a clean scan.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · ingest-photo.sh (reported line 147)May include surrounding context.

sh
cp "$photo" "$dir/$dest"
if ! strip_out="$(exiftool -all= -overwrite_original "$dir/$dest" 2>&1)"; then
  rm -f "$dir/$dest"
  die "exiftool could not rewrite $base (${strip_out##*$'\n'}) — not adding it"
fi
# The verify must fail closed: an exiftool error here is NOT a clean scan.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · ingest-photo.sh (reported line 151)May include surrounding context.

sh
cp "$photo" "$dir/$dest"
if ! strip_out="$(exiftool -all= -overwrite_original "$dir/$dest" 2>&1)"; then
  rm -f "$dir/$dest"
  die "exiftool could not rewrite $base (${strip_out##*$'\n'}) — not adding it"
fi
# The verify must fail closed: an exiftool error here is NOT a clean scan.

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · pillars.example.md (reported line 1)May include surrounding context.

md
<!-- TEMPLATE — delete this line once you have edited the file. While it is present, the skill ignores this file and runs the default schedule. -->
# Pillar configuration — personal overlay

Copy this file to `postflight-state/pillars.local.md` — not next to this

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · PUBLISH-API.md (reported line 96)May include surrounding context.

literal string and does NOT support curl's @file form — -d @path sends the characters @path as data. Never paste the tweet text inline inside -d '...' either: quotes in the text would break the command. Write the text with a quoted heredoc (the same draft.txt from the DRAFTING.md length check) and let jq build the body:

sh

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The manifest description includes broad triggers such as cron messages that 'mention postflight', general requests for tweet drafts, ship/skip/edit replies, forwarded x.com links, and photos. That ambiguity can cause the skill to activate in unintended contexts, increasing the chance of unauthorized drafting, state changes, or even publishing flows being entered when a different action was intended.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.

tail -n 20 postflight-state/post-log.jsonl

text

Write it that way: `postflight-state/...`, no leading path, no `~`, no
directory you worked out yourself. Never `cd` and then use it — if a command
has to run somewhere else, put the `cd` in a subshell
(`(cd postflight-state/media && vhs demo.tape)`) so the next command still

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The instructions direct the agent to create temp files for note and location content, run an ingestion script that files the photo into the library, and then delete the temp files. While these operations are central to the skill, the markdown does not explicitly warn the user that their photo and caption-derived data will be written to disk and cleaned up as part of processing.

Content

No source excerpt is available for this finding.