ClawHub
Back to skill

Security audit

IG Comment Strategist

Security checks for vulnerabilities and agentic risk

Overview

This is a small Instagram comment-planning skill with optional email reporting; the main issue is privacy caution around emailed reports, not hidden or malicious behavior.

Install only if you are comfortable using it for Instagram comment strategy. Prefer local reports for sensitive campaigns; if using --email, assume the report contents and Instagram URLs may pass through your SMTP provider, use app passwords or a secret manager for SMTP credentials, enable TLS, and send only to trusted recipients.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The README advertises email reporting for analysis results but does not disclose that Instagram URLs, derived content, or potentially sensitive engagement data may be transmitted through email infrastructure. This creates a privacy and data-handling risk because users may unknowingly send third-party content or campaign intelligence over insecure or unintended channels, especially in agency or multi-account workflows.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill advertises email reporting as a feature but does not warn users that analysis results, URLs, or potentially sensitive campaign data may be transmitted off-system through SMTP. In an agent context, this can lead to unintentional data exfiltration or privacy violations because users may invoke the feature without understanding that external delivery is occurring.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The quick-start command shows how to send analysis by email but provides no adjacent warning that using --email causes outbound transmission of generated analysis and associated metadata. Because users often copy-paste quick-start examples verbatim, this omission increases the likelihood of accidental disclosure to third-party mail servers or unintended recipients.

Static analysis

No suspicious patterns detected.