ClawHub
Back to skill

Security audit

Social Media Toolkit

Security checks for vulnerabilities and agentic risk

Overview

This skill is a social-media automation toolkit that openly documents powerful bulk account actions, but its scope and safeguards are not clear enough for those actions.

Review before installing. Only use this skill with accounts and APIs where you are authorized to perform bulk social actions, and require dry-run previews plus explicit confirmation before sending messages, liking/swiping, declining relationships, or changing relationship states. Treat tokens as sensitive and keep them in environment variables.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

Missing User Warnings

High
Confidence
97% confidence
Finding
The skill promotes bulk swiping, bulk messaging, and automated relationship management without a prominent warning that these actions affect external accounts and interpersonal interactions. In this context, the skill can perform high-volume outbound actions that may violate platform rules, spam users, or cause reputational and account harm if run unintentionally or at scale.

Missing User Warnings

High
Confidence
96% confidence
Finding
The relationship orchestration and batch decline flows perform sensitive state changes without clear user-facing warnings about reversibility, consent, or downstream effects. Because these operations alter social relationship status and may reject or transition users in bulk, mistakes can directly damage relationships, create abuse risks, and be hard to undo.

Intent-Code Divergence

High
Confidence
98% confidence
Finding
The skill's documented inputs/outputs describe a code-review scoring tool, while the rest of the file describes social-media automation. This mismatch can mislead users and agents about what actions will occur, undermining informed consent and increasing the chance that automation or external actions are triggered under false assumptions.

Vague Triggers

Medium
Confidence
87% confidence
Finding
The manifest uses broad, ambiguous activation language such as generic data analysis and report generation cues, even though the skill can perform social-media automation and external account actions. Overbroad triggers can cause the skill to activate in contexts where the user did not intend account-affecting behavior, increasing the risk of unsafe or surprising execution.

Natural-Language Policy Violations

Medium
Confidence
93% confidence
Finding
The description states '支持中文交互' and the document is framed around Chinese interaction, but it does not present this as an optional preference or a justified region-specific constraint. That can violate language-choice policy by implying a fixed language without explicit user opt-in.

External Transmission

Medium
Category
Data Exfiltration
Content
团队有 10 个 Agent 需要同时运营社交网络。配置批量滑动策略，按兼容度阈值自动 like 候选 Agent，批量发送个性化开场白，自动管理关系状态流转.
```bash
# 批量滑动：对兼容度 > 0.7 的候选自动 like
curl -X POST "toolkit_result"/api/batch/swipes \
  -H "Authorization: Bearer "toolkit_metadata"" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
93% confidence
Finding
The skill includes examples that transmit authorization tokens and perform live POST requests to external social-media APIs for batch actions. In a skill with exec capability and automation semantics, this creates real risk of unintended external actions, token misuse, privacy exposure, and high-impact account changes if an agent follows the examples without strict consent controls.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
id: "executor-01"
      role: "relationship"
      permissions: ["relationship:manage", "chat:send"]
      auto_confirm: false
```

### 场景三：数据驱动匹配优化（产品视角）
Confidence
85% confidence
Finding
The skill defines role-based automation for discovery, swiping, chat sending, and relationship management, which delegates socially significant decisions to agents. Even though auto_confirm is false in the example, the overall design still encourages automated decision-making over external user interactions, creating consent, policy, and harm risks if thresholds or permissions are misconfigured.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:71