ClawHub
Back to skill

Security audit

Supapost

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for Supapost content workflows, but it asks users to grant social-account and API-key access while using risky plaintext credential and unpinned package execution guidance.

Review before installing. Use a narrowly scoped, revocable Supapost API key, avoid putting real tokens in project files, pin package versions where possible, and require explicit confirmation before scheduling, publishing drafts, or changing influencer/project state.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T08 · Insecure Dependencies

Error
Location
SKILL.md:33
Finding

Unpinned npm Package Execution During Skill Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 33-39
Vulnerability Type: Unpinned third-party package execution
Risk Level: High

Vulnerable Code

markdown
Use the [vercel-labs/skills](https://github.com/vercel-labs/skills) CLI to drop the `SKILL.md` into your coding agent's skills folder (Claude Code, Cursor, OpenCode, OpenClaw, etc.):

```bash
npx skills add supapost-dev/skills
text

### Technical Analysis

The installation procedure invokes the npm package `skills` through `npx` without specifying an exact package version or integrity hash. `npx` can download and immediately execute the version currently resolved by the npm registry. Consequently, the code executed by this command can change after the Skill has been reviewed.

This creates a supply-chain boundary outside the audited project. Compromise of the package, its maintainer account, its transitive dependencies, or the registry resolution process could result in arbitrary local code execution. The command executes with the permissions of the user running the coding agent or terminal.

### Attack Path

1. An attacker compromises the referenced npm package, a maintainer account, or a transitive dependency.
2. The attacker publishes a malicious version that is selected by the unpinned `npx skills` invocation.
3. A user follows the installation instructions and runs `npx skills add supapost-dev/skills`.
4. `npx` downloads and executes the changed package.
5. The malicious package gains the invoking user's local privileges and can access files, credentials, development repositories, and network resources available to that user.

### Impact Assessment

Successful exploitation permits arbitrary code execution under the invoking user's account. The resulting scope can include source-code repositories, agent configuration, environment variables, SSH or API credentials readable by that account, and any network services accessible from th
...[truncated 160 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin the installer to an explicitly reviewed version, such as npx skills@X.Y.Z.
  • Publish and verify package provenance and integrity information before execution.
  • Use a lockfile or otherwise pin all transitive dependencies where feasible.
  • Prefer downloading and inspecting the package before executing it.
  • Document the expected package publisher, repository, version, and checksum so users can detect substitution.
  • Run installation in a restricted environment without unnecessary credentials or access to sensitive repositories.

T08 · Insecure Dependencies

Error
Location
SKILL.md:69
Finding

Unpinned MCP Package Is Automatically Downloaded and Executed

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 69
Vulnerability Type: Unpinned third-party package execution with automatic confirmation
Risk Level: High

Vulnerable Code

markdown
**Local stdio (MCP developers only):** if you need to run the server locally against a custom `SUPAPOST_API_URL`, use the stdio package: `claude mcp add supapost --env SUPAPOST_API_KEY=sp_... -- npx -y @supapost/mcp`.

Technical Analysis

The local MCP setup executes @supapost/mcp through npx without an exact version or integrity constraint. The -y option automatically accepts installation, removing an opportunity for the user to review the resolved package and version before execution.

Although running an MCP server is necessary for the documented local-development workflow, dynamically executing an unpinned package exceeds the minimum supply-chain trust required. The effective executable payload can change independently of the reviewed SKILL.md.

The command also supplies SUPAPOST_API_KEY to the launched process. Access to that key is functionally required for the MCP service, but a maliciously modified package could read and exfiltrate it in addition to executing arbitrary local operations.

Attack Path

  1. An attacker compromises @supapost/mcp, its publisher account, or one of its dependencies.
  2. A malicious release becomes the version selected by the unpinned package reference.
  3. A developer follows the documented command.
  4. npx -y downloads and executes the package without an installation confirmation.
  5. The malicious process reads the supplied SUPAPOST_API_KEY and any other data available to the invoking user.
  6. The process may exfiltrate credentials, modify local files, or use the Supapost key against the remote service.

Impact Assessment

Exploitation can result in arbitrary code execution with the invoking user's privileges and disclosure of SUPAPOST_API_KEY. A stole ...[truncated 326 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin @supapost/mcp to a reviewed exact version.
  • Remove -y so users can review package installation details.
  • Provide package checksums, signed provenance, and a link to the corresponding reviewed source revision.
  • Pin and audit transitive dependencies through a lockfile and automated dependency scanning.
  • Run the MCP process with restricted filesystem and network permissions.
  • Supply the API key through a protected secret-management mechanism and limit its server-side permissions.
  • Recommend short-lived or readily revocable credentials for local development.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:55
Finding

Bearer API Key Is Instructed to Be Stored in Plaintext MCP Configuration

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 55-66
Vulnerability Type: Plaintext sensitive credential storage
Risk Level: Medium

Vulnerable Code

markdown
**Cursor / Windsurf / VS Code / any MCP client** — add to `~/.cursor/mcp.json` (or `.mcp.json` in the project root):

```json
{
  "mcpServers": {
    "supapost": {
      "url": "https://mcp.supapost.so",
      "headers": { "Authorization": "Bearer sp_..." }
    }
  }
}
text

### Technical Analysis

The instructions place a reusable bearer credential directly in a JSON configuration file. A user-level file may be readable by other local software or accounts if permissions are too broad. A project-root `.mcp.json` presents additional exposure because it may be committed to version control, copied into archives, shared with collaborators, indexed by development tools, or included in agent context.

Possession of a bearer key is sufficient for authentication; no additional proof of identity is described. This makes accidental disclosure directly actionable. The guidance also conflicts with the later rule stating that the key must never be pasted into files and “lives only in the MCP env.”

Configuring authentication is necessary for the declared MCP functionality, but persisting a literal API key in project configuration is not the least-privilege method. Environment-variable interpolation, an operating-system credential store, or a client secret manager would reduce exposure.

### Attack Path

1. A user replaces `sp_...` with a real Supapost API key in `.mcp.json`.
2. The project-level file is accidentally committed, shared, archived, exposed through an agent, or read by another local process.
3. An attacker extracts the plaintext bearer token.
4. The attacker submits the token to the Supapost MCP or associated API.
5. The attacker performs operations allowed by the key until it is revoked or expires.

### Impact Assessmen
...[truncated 616 chars]
Remediation
View remediation

Remediation Suggestions

  • Do not place literal bearer tokens in project-root configuration files.
  • Use environment-variable interpolation or the MCP client's supported secret store.
  • Prefer an operating-system credential manager for persistent secrets.
  • Add .mcp.json to .gitignore and repository secret-scanning rules as defense in depth.
  • If a client requires a local credential file, enforce owner-only permissions and keep it outside the repository.
  • Clearly reconcile the setup instructions with the rule that the key must live only in the MCP environment.
  • Issue narrowly scoped, short-lived, and readily revocable API keys where supported.
  • Document immediate rotation procedures for keys that are committed, shared, or otherwise exposed.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

md
he [vercel-labs/skills](https://github.com/vercel-labs/skills) CLI to drop the `SKILL.md` into your coding agent's skills folder (Claude Code, Cursor, OpenCode,

Session Persistence

Medium
Category
Rogue Agent
Confidence
72% confidence
Finding

The skill is explicitly designed to manage persistent entities such as AI influencers, projects, assets, and scheduled posts across connected accounts. That persistence is not inherently malicious, but it does create stateful side effects that can outlast the session, making accidental or unauthorized changes more consequential in the context of social publishing and identity locking.

Content

Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.

md
---
name: supapost
version: 1.0.1
description: Generate AI images and video, build TikTok slideshows, manage AI influencers, and schedule posts to TikTok / Instagram / YouTube / X through the Supapost MCP. Use whenever the user asks to create social content, run image-to-video, lock a character identity, or queue posts across connected accounts.
license: MIT-0
homepage: https://supapost.so/developers/openclaw
repository: https://github.com/supapost-dev/skills

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The invocation text says to use the skill whenever the user asks to create social content, generate media, manage influencer identity, or queue posts across connected accounts. Those broad triggers can cause the agent to select a high-privilege skill in many ambiguous situations, increasing the chance of unintended posting, account operations, or external data transfer without sufficiently explicit user intent.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The skill instructs users to run npx skills add supapost-dev/skills without pinning a specific package version. This allows execution of whatever version is current at install time, creating supply-chain risk if the package is compromised or a breaking/malicious release is published.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The stdio install guidance runs npx -y @supapost/mcp with no pinned version, which executes the latest published package from the registry. Because this package is intended to handle API credentials and connect to external services, an upstream compromise could directly expose secrets or enable arbitrary code execution on the user's machine.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.