ClawHub
Back to skill

Security audit

AutoPost GitHub Bounty

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed social-media automation tool that can publish externally, so it is usable but should be installed only with accounts and credentials you intend it to control.

Before installing, connect only social accounts you are comfortable letting the skill post from, use dry-run or preview mode first, review generated content and target platforms before scheduling, and prefer least-privilege or revocable platform tokens. Update or pin dependencies, especially axios, before production use.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill explicitly describes automatically sending generated content to social media platforms and requires platform API tokens, but it does not warn users about outbound posting, data sharing, or the risk of unintended publication. In an agent context, undocumented external posting behavior can lead to accidental disclosure of repository information, spam, reputational harm, or unauthorized actions on linked social accounts.

Unpinned Dependencies

Low
Category
Supply Chain
Content
"author": "Toàn Vũ",
  "license": "MIT",
  "dependencies": {
    "axios": "^1.4.0",
    "dotenv": "^16.0.0"
  }
}
Confidence
88% confidence
Finding
Using a caret range for axios allows automatic installation of newer minor/patch versions, which reduces build reproducibility and can introduce unexpected supply-chain changes. In a package that appears to automate posting and likely performs network actions, dependency drift can increase the chance of pulling in a compromised or breaking release without review.

Unpinned Dependencies

Low
Category
Supply Chain
Content
"license": "MIT",
  "dependencies": {
    "axios": "^1.4.0",
    "dotenv": "^16.0.0"
  }
}
Confidence
84% confidence
Finding
Using a caret range for dotenv permits non-deterministic installs across environments, which is a supply-chain hygiene weakness even if dotenv itself is not obviously dangerous here. The risk is lower than for a network-facing library, but unexpected package changes can still affect runtime behavior or introduce compromised transitive code.

Known Vulnerable Dependency: axios==1.4.0 — 10 advisory(ies): CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF); CVE-2026-42044 (Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `pars); CVE-2026-25639 (Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig) +7 more

High
Category
Supply Chain
Confidence
97% confidence
Finding
The manifest explicitly allows axios 1.4.0, which is flagged with multiple advisories including SSRF-related and prototype-pollution/DoS issues. Given this skill's stated purpose of automated posting, it likely performs outbound HTTP requests, making a vulnerable HTTP client especially relevant and increasing the practical attack surface.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
autopost.js:11