ClawHub
Back to skill

Security audit

Upload Videos🎥, Photos📸 & Text🖊️ to TikTok, Instagram, YouTube, X, LinkedIn, Facebook, Threads, Pinterest, Reddit & Bluesky via Upload-Post API

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent Upload-Post API guide, but it can publish, schedule, edit, and cancel posts across connected social accounts without clear confirmation safeguards.

Install only if you trust Upload-Post with the connected accounts and uploaded content. Use a limited/dedicated profile and API key, protect and rotate keys, and require explicit review of the exact content, files, destination platforms, visibility, profile, schedule, and job_id before any publish, edit, cancel, document upload, or FFmpeg processing request.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
This markdown file describes setup and authentication for an external posting API, including generating an API key and connecting social media accounts, but it does not include any explicit warning about handling credentials or sending account/content data to a third-party service. Because the skill affects privacy and account integrity across multiple platforms, a user-facing warning would help users understand the implications before use.

External Transmission

Medium
Category
Data Exfiltration
Content
-H "Authorization: Apikey YOUR_KEY"

# LinkedIn Pages  
curl "https://api.upload-post.com/api/uploadposts/linkedin/pages" \
  -H "Authorization: Apikey YOUR_KEY"

# Pinterest Boards
Confidence
50% confidence
Finding
https://api.upload-post.com/

Tool Parameter Abuse

High
Category
Tool Misuse
Content
Response includes `job_id`. Manage with:
- `GET /uploadposts/schedule` - List all scheduled
- `DELETE /uploadposts/schedule/<job_id>` - Cancel
- `PATCH /uploadposts/schedule/<job_id>` - Edit (date, title, caption)

## Check Upload Status
Confidence
80% confidence
Finding
DELETE /uploadposts/schedule/<job_id>`

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.