ClawHub
Back to skill

Security audit

Daily Social Media Publisher

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed social media posting tool, but it can publish externally on a schedule and has unsafe network and credential handling that warrants review before installation.

Install only after reviewing the public-posting workflow and credentials. Use least-privilege API keys, protect the JSON config files, avoid passing secrets on the command line, restrict outbound network access to the intended provider domains, and require human approval or a dry run before scheduled posts go live.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
index.py:73
Finding

Configurable API Endpoints Can Exfiltrate Bearer Credentials

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
index.py:84
Finding

Unvalidated Render URL Enables Server-Side Request Forgery and Response Relay

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
index.py:161
Finding

NewsAPI Credential Is Required as a Command-Line Argument

Content
View full analysis
`. 2. The complete invocation is retained in shell history, orchestration ...[truncated 628 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (16)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The description understates the skill's real behavior: it not only retrieves news, but also renders media, reads local config files, writes output, and publishes content to third-party platforms on a schedule. This mismatch is dangerous because users may approve or invoke the skill without understanding that it performs external posting and broader data handling than the title and summary imply.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill declares no explicit tool scope even though its documented behavior requires file access, network access, and likely file output. In an agent environment, missing permission boundaries can allow broader-than-expected execution and reduce a user's ability to assess or constrain what the skill is allowed to do.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill automates recurring publication to social-media-related APIs, but the description does not clearly warn users that it can post externally on a schedule. In context, this increases the risk of unintended publication, reputational harm, and unauthorized outbound actions because operators may treat it as simple content generation rather than autonomous posting.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill lists API keys and third-party providers but does not warn that content, metadata, and potentially sensitive business information are transmitted to external services. This is risky because users may supply credentials and content without understanding the data-sharing implications or the trust boundary introduced by those vendors.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

The documented UploadPost endpoint confirms that the skill sends data to an external service, which creates an exfiltration and trust-boundary risk even if the behavior is intended. In this skill's context, outbound transmission is central to functionality, but it remains dangerous if not tightly disclosed and constrained because media, generated content, and credentials-related operations interact with third-party infrastructure.

Content

Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.

json
{
  "api_key": "...",
  "endpoint": "https://api.upload-post.com/api/upload_photos"
}

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The NewsAPI query explicitly forces English-language content, and the same constraint appears again in the relationship news fetch path. This imposes a language choice without user opt-in and is a natural-language locale policy issue under the stated rules.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The NewsAPI query explicitly forces English-language content, and the file does not provide a way for the user to select another language or acknowledge this restriction. That makes the locale constraint a policy concern rather than an implementation detail.

Content

No source excerpt is available for this finding.

Tainted flow: 'data' from requests.get (line 47, network input) → requests.post (network output)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · index.py (reported line 94)May include surrounding context.

python
}

        try:
            r = requests.post(
                self.tpl_cfg.get('endpoint', 'https://api.templated.io/v1/render'),
                headers=headers, json=data, timeout=60
            )

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · index.py (reported line 95)May include surrounding context.

python
try:
            r = requests.post(
                self.tpl_cfg.get('endpoint', 'https://api.templated.io/v1/render'),
                headers=headers, json=data, timeout=60
            )
            if r.status_code == 200:

Tainted flow: 'url' from requests.post (line 99, network input) → requests.get (network output)

Medium
Category
Data Flow
Confidence
96% confidence
Finding

The code blindly trusts a render_url returned by an external API and immediately fetches it with requests.get. If the rendering service or its response is compromised, this can be used for SSRF-style behavior, internal network probing, or downloading unexpected content from attacker-controlled URLs.

Content

Scanner excerpt · index.py (reported line 101)May include surrounding context.

python
if r.status_code == 200:
                url = r.json().get('render_url')
                if url:
                    img = requests.get(url, timeout=30)
                    if img.status_code == 200:
                        return {"url": url, "data": img.content}
        except Exception as e:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This code sends image data and captions to a third-party publishing endpoint, which can affect public-facing accounts and transmit user/system-generated data externally. While publishing is part of the skill's purpose, this file provides no confirmation prompt or user-facing disclosure before the outbound post occurs.

Content

No source excerpt is available for this finding.

Tainted flow: 'data' from requests.get (line 47, network input) → requests.post (network output)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · index.py (reported line 115)May include surrounding context.

python
data = {"caption": caption}

        try:
            r = requests.post(
                self.upload_cfg.get('endpoint', 'https://api.upload-post.com/api/upload_photos'),
                headers=headers, files=files, data=data, timeout=60
            )

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · index.py (reported line 116)May include surrounding context.

python
try:
            r = requests.post(
                self.upload_cfg.get('endpoint', 'https://api.upload-post.com/api/upload_photos'),
                headers=headers, files=files, data=data, timeout=60
            )
            return r.json()

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This JSON file contains only generic promotional phrases such as tax reminders, refunds, and compliance benefits, but provides no specific invocation phrases, scope limits, or exclusion conditions. If these strings are used as activation or matching text in a manifest-like context, they are ambiguous and could overlap with common tax-related user speech, increasing the risk of unintended invocation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The config sets "timezone":"Africa/Johannesburg" directly, which imposes a locale-specific operating context in natural-language-adjacent configuration without indicating that users can choose or override it. The policy allows locale constraints when clearly documented and justified, but this single-line config provides no such justification or opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
76% confidence
Finding

The script persists execution results, including posting metadata, to a local JSON file. This is a file write operation, and the file does not include an explicit warning, prompt, or explanatory comment about saving output to disk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.