Security audit

Openclaw Adaptlypost

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed AdaptlyPost integration for scheduling and publishing social media content, with high-impact posting behavior clearly tied to its purpose.

Install only if you intend to let an agent act on your AdaptlyPost account. Use a dedicated revocable token, connect only the social accounts the agent needs, confirm every post before it is published or scheduled, and provide only media files or public URLs you are comfortable uploading to externally reachable storage.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill clearly performs network operations against a third-party SaaS API, but the static finding indicates those capabilities are not declared as permissions. Missing capability declarations can mislead operators and policy engines about what the skill can do, reducing transparency and weakening review or sandbox controls. In this context, the risk is meaningful because the skill can publish public content and upload media to externally reachable URLs.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The function `uploadRemoteUrl` will fetch any caller-supplied URL and then re-upload the content to AdaptlyPost storage without validating the destination, scheme, or whether the host is private/internal. This creates a general-purpose network fetch primitive that exceeds the skill's stated social-posting scope and can be abused for SSRF-style access to internal services or for exfiltrating data from arbitrary URLs into the SaaS platform.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The skill exposes a general-purpose remote fetch capability via uploadRemoteUrl(), which will download any caller-supplied URL and then upload the contents to external storage. In an agent/plugin context, this expands the tool beyond social-post scheduling into arbitrary network retrieval, which can be abused for SSRF-like access to internal resources, metadata endpoints, or unintended data movement if higher layers do not strictly constrain inputs.

Context-Inappropriate Capability

Medium

Confidence: 83% confidence
Finding: The API exposes account-connection link minting and revocation capabilities that are not described in the skill manifest, expanding the tool's authority beyond straightforward post scheduling. Because the minted link can let anyone holding it attach a social account to the account group, an agent could unintentionally create or share a sensitive onboarding secret without the user understanding this risk.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The description contains broad trigger phrases like scheduling posts, managing content, uploading media, cross-posting, and automating workflows across many platforms. Overbroad activation increases the chance the agent invokes this skill for loosely related social-media requests, which can route user content and account actions to a high-impact external posting tool unexpectedly. The surrounding safety guidance reduces misuse after activation, but does not eliminate the risk of inappropriate selection in the first place.

Missing User Warnings

Medium

Confidence: 78% confidence
Finding: This code performs remote URL retrieval and re-upload silently, with no built-in warning, consent check, or provenance disclosure at the point of use. While lack of disclosure alone is not as severe as the fetch capability itself, it increases the chance that users or downstream tooling invoke a sensitive network action without understanding that arbitrary third-party resources will be contacted and copied.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The media upload tool accepts arbitrary local file paths and remote URLs, then uploads or fetches them to/from an external SaaS without any in-tool confirmation or explicit warning about data transmission. In an agent setting, this creates a real privacy and data-exfiltration risk because an LLM or workflow may pass sensitive local files or internal URLs to the tool as part of normal task completion.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The create-post tool can immediately publish or schedule content to multiple external social accounts, which is a meaningful external side effect, but it lacks an explicit confirmation or safety gate in the tool itself. In an autonomous or loosely supervised agent flow, this increases the risk of accidental posting, reputational harm, spammy behavior, or unintended publication of sensitive content.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.