Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed RedReplier integration that uses a revocable API token to read and manage social mention data without hidden local persistence or unrelated behavior.
Install only with a dedicated, revocable RedReplier token for the workspace you want the agent to access. Expect the skill/plugin to read mention and keyword data, add keywords, generate mention explanations, and approve or reject mentions; treat any direct REST use of delete endpoints as destructive and require explicit confirmation naming the affected keyword or website.
The declared description describes a concrete SaaS integration for brand mention monitoring across multiple social platforms. The actual code shown is merely a type declaration for an OpenClaw plugin export and contains no observable business logic related to RedReplier or social-media monitoring. This is a material mismatch in primary purpose and implemented capabilities.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Most RedReplier operations are safe and reversible (listing mentions, approving/rejecting). The API never charges: no endpoint upgrades the plan. Two actions destroy data and need explicit confirmation:
1. **`DELETE /keywords/{id}`** permanently deletes the keyword in any status together with every mention it produced. There is no undo. Confirm with the user first and name the keyword, not just the ID. Use `POST /keywords/{id}/disable` to stop monitoring and keep the mentions.
2. **`DELETE /websites/{id}`** stops all monitoring for the website. There is no restore endpoint (re-creating the same URL revives the record). Confirm with the user first; name the website (domain), not just the ID.
Other guidance:
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Most RedReplier operations are safe and reversible (listing mentions, approving/rejecting). The API never charges: no endpoint upgrades the plan. Two actions destroy data and need explicit confirmation:
1. **`DELETE /keywords/{id}`** permanently deletes the keyword in any status together with every mention it produced. There is no undo. Confirm with the user first and name the keyword, not just the ID. Use `POST /keywords/{id}/disable` to stop monitoring and keep the mentions.
2. **`DELETE /websites/{id}`** stops all monitoring for the website. There is no restore endpoint (re-creating the same URL revives the record). Confirm with the user first; name the website (domain), not just the ID.
Other guidance:
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- `PATCH /keywords/{id}` `{ "value": "new" }`: reword in place (unlimited, re-graded, keeps its slot). Use it to fix a `SUSPENDED` keyword or instead of adding a variant.
- `POST /keywords/{id}/disable`: stop one keyword immediately (unlimited, reversible). It frees its slot at once and keeps its mentions.
- `POST /keywords/{id}/enable`: bring back one `DISABLED` keyword. It goes `ACTIVE` when the plan has a free slot, otherwise `PENDING`. Never charges. `GET /keywords/billing-preview?desiredKeywordCount=N` (N = absolute active total wanted) prices the upgrade the user would make in the app.
- `DELETE /keywords/{id}`: permanently delete a keyword in any status together with every mention it produced. No undo and no refund; confirm first, and disable instead to keep the mentions.
### 4. List mentions (the leads)
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Both fields optional; omitted fields keep their value, and an empty `description` clears it. The description is the AI scoring context; mentions already scored are not rescored. URL and keywords cannot be changed here. Returns the updated website with its keywords.
### DELETE /websites/{id}
Soft-deletes the website: it leaves `GET /websites` at once and its keywords stop matching. No restore endpoint; `POST /websites` with the same URL revives the record. Use `POST /keywords/{id}/disable` instead to pause a single keyword. Returns `{ "deleted": true }`.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Re-activates one keyword. Goes `ACTIVE` at once if the plan has a free slot, otherwise it is set `PENDING`. Never charges: the user upgrades the plan in the RedReplier app, and `GET /keywords/billing-preview` shows what that would cost. An already `ACTIVE` keyword is returned unchanged. Use `activate-pending` to promote every `PENDING` keyword that fits instead. Returns the keyword.
### DELETE /keywords/{id}
Permanently deletes a keyword in any status **and every mention it produced**. No undo. Deleting an `ACTIVE` keyword frees its slot the same way disabling does, with no refund; disable instead to keep the mentions. Returns `{ "deleted": true }`.
Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.
## Default behavior (no params)
`GET /mentions` with no filters applies two implicit filters:
1. **Excludes `REJECTED`** mentions.
2. **Hides anything below the website's minimum score** (30 unless the website has its own threshold), i.e. only `relevanceScore >= minimum` OR not-yet-scored mentions are shown.
The skill clearly performs authenticated network operations against an external SaaS API, but it does not declare any explicit tool scope such as allowed tools or network permissions. That weakens policy enforcement and reviewability, because an agent runtime may allow broader-than-intended outbound access or fail to constrain this skill to its documented endpoint.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -s -H "Authorization: Bearer $REDREPLIER_API_KEY" \
https://ai.redreplier.com/ai-app/api/v1/websites
This code registers multiple tools that send requests to external endpoints via callApi, including listing mentions, generating explanations, changing mention status, and adding keywords. While the descriptions explain functionality, there is no explicit user-facing warning about transmitting account, mention, or keyword data to a remote service, and this file contains no confirmation prompt, logging, or disclosure beyond operational descriptions.
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
"openclaw": ">=2026.8.0"
},
"dependencies": {
"@sinclair/typebox": "^0.34.52"
},
"devDependencies": {
"@types/node": "^22.10.0",
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
"@sinclair/typebox": "^0.34.52"
},
"devDependencies": {
"@types/node": "^22.10.0",
"openclaw": "2026.8.1",
"typescript": "^5.6.0"
},
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
"devDependencies": {
"@types/node": "^22.10.0",
"openclaw": "2026.8.1",
"typescript": "^5.6.0"
},
"repository": {
"type": "git",
No suspicious patterns detected.