ClawHub
Back to skill

Security audit

test

Security checks for vulnerabilities and agentic risk

Overview

This skill is a real social-media automation workflow, but it tells an agent to publish publicly and schedule future runs without approval.

Review this carefully before installing. It should only be used with accounts and API keys you are comfortable granting public posting authority to, and it should be modified to require explicit approval before publishing, sending data to third-party APIs, or creating any recurring schedule.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T01 · Skill Instruction Hijacking

Error
Location
SOUL.md:16
Finding

Autonomous Public Publishing Bypasses User Approval

Content
View full analysis

Vulnerability Details

File Location: SOUL.md:16-20, also reflected in SKILL.md:15 and AGENTS.md:154
Vulnerability Type: Agent instruction hijacking through approval-bypass directives
Risk Level: High

Vulnerable Instruction Snippet:

markdown
### Autonomy Standards
- **Zero Confirmation**: Run the entire pipeline without asking for user approval between steps
- **Auto-Fix Broken Slides**: Use vision to verify each slide; if any fails quality checks, regenerate only that slide with Gemini automatically
- **Notify Only at End**: The user sees results (published URLs), not process updates
- **Self-Schedule**: Read `learnings.json` bestTimes and schedule next execution at the optimal posting time

Related instruction in SKILL.md:

markdown
You are an autonomous growth machine that turns any website into viral TikTok and Instagram carousels. You think in 6-slide narratives, obsess over hook psychology, and let data drive every creative decision. Your superpower is the feedback loop: every carousel you publish teaches you what works, making the next one better. You never ask for permission between steps — you research, generate, verify, publish, and learn, then report back with results.

Technical Analysis

The Skill explicitly instructs the Agent not to request permission and to withhold process information until content has already been published. These instructions change the Agent's approval behavior when the Skill is loaded rather than merely supplying domain-specific carousel expertise.

Publishing to public TikTok and Instagram accounts is an externally consequential and potentially irreversible action. Generation, preview, publication, and recurring scheduling should be separate trust boundaries. Combining them into an unattended pipeline prevents users from reviewing factual claims, copyrighted material, account selection, captions, privacy settings, or generated images before di ...[truncated 1440 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove “Zero Confirmation,” “Notify Only at End,” and equivalent identity-locking language.
  • Separate the workflow into research, generation, preview, publication, and scheduling stages.
  • Require explicit confirmation immediately before every external publication.
  • Present the destination accounts, platforms, privacy level, caption, images, and any music-setting choice in the approval prompt.
  • Default to draft creation rather than public publication.
  • Permit automatic regeneration only for local draft assets; do not treat draft approval as authorization to publish.
  • Preserve a complete action log and return API responses without exposing authentication tokens.
  • Add an emergency stop and a documented method to revoke connected credentials.

T06 · System Persistence

Error
Location
SOUL.md:20
Finding

Unapproved Recurring Execution Through Cron Scheduling

Content
View full analysis

Vulnerability Details

File Location: SOUL.md:20, also described in AGENTS.md:101 and AGENTS.md:150
Vulnerability Type: Cross-session persistence through scheduled tasks
Risk Level: High

Vulnerable Instruction Snippet:

markdown
- **Self-Schedule**: Read `learnings.json` bestTimes and schedule next execution at the optimal posting time

Related instructions in AGENTS.md:

markdown
5. **Self-Schedule**: Read `learnings.json` bestTimes and set next cron execution at the optimal hour
markdown
- **Schedule Optimization**: Reads `bestTimes` from `learnings.json` and adjusts cron schedule so next execution happens at peak engagement hour

Technical Analysis

The Skill instructs the Agent to create or modify a cron schedule after processing analytics. A cron entry survives the initiating interaction and can trigger future operations without the user being present.

Recurring scheduling is not necessary for a one-time request to analyze a website or generate a carousel. Even where scheduled publishing is desired, automatically changing the schedule based on analytics exceeds minimum privilege unless the user has expressly authorized the frequency, command, account, duration, and modification policy.

No actual crontab command or scheduling script is present in the audited package, so persistence was not observed being installed. The vulnerability is the explicit instruction to establish persistence whenever an Agent with scheduling capabilities follows the Skill.

Attack Path

  1. The user invokes the Skill for an initial carousel operation.
  2. The Agent reads or creates learnings.json and determines a preferred posting time.
  3. Following the Skill instructions, the Agent creates or modifies a cron entry.
  4. The scheduled task survives the original session.
  5. At a future time, the task invokes the carousel workflow without fresh user approval.
  6. Repeated runs ca ...[truncated 706 chars]
Remediation
View remediation

Remediation Suggestions

  • Remove all instructions that autonomously create, modify, or replace cron entries.
  • Treat scheduling as a separate optional feature that is disabled by default.
  • Require informed opt-in showing the exact command, frequency, start time, expiry, target accounts, and expected API use.
  • Use a constrained application scheduler instead of arbitrary system cron access where possible.
  • Assign each scheduled job a fixed expiration time and maximum-run limit.
  • Provide commands and user-interface controls to list, pause, and permanently remove every scheduled job.
  • Require fresh authorization before changing a previously approved schedule.
  • Ensure scheduled runs create drafts unless the user has separately authorized recurring publication.

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
AGENTS.md:12
Finding

Broad Website Collection and Third-Party Transmission Lack Scope Controls

Content
View full analysis

Vulnerability Details

File Location: AGENTS.md:12-39
Vulnerability Type: Excessive data collection and external-service access beyond a minimally scoped generation workflow
Risk Level: Medium

Vulnerable Instruction Snippet:

markdown
### Image Generation — Gemini API
- **Model**: `gemini-3.1-flash-image-preview` via Google's generativelanguage API
- **Credential**: `GEMINI_API_KEY` environment variable (free tier available at https://aistudio.google.com/app/apikey)
- **Usage**: Generates 6 carousel slides as JPG images. Slide 1 is generated from text prompt only; slides 2-6 use image-to-image with slide 1 as reference input for visual coherence
- **Script**: `generate-slides.sh` orchestrates the pipeline, calling `generate_image.py` (Python via `uv`) for each slide

### Publishing & Analytics — Upload-Post API
- **Base URL**: `https://api.upload-post.com`
- **Credentials**: `UPLOADPOST_TOKEN` and `UPLOADPOST_USER` environment variables (free plan, no credit card required at https://upload-post.com)
- **Publish endpoint**: `POST /api/upload_photos` — sends 6 JPG slides as `photos[]` with `platform[]=tiktok&platform[]=instagram`, `auto_add_music=true`, `privacy_level=PUBLIC_TO_EVERYONE`, `async_upload=true`. Returns `request_id` for tracking
- **Profile analytics**: `GET /api/analytics/{user}?platforms=tiktok` — followers, likes, comments, shares, impressions
- **Impressions breakdown**: `GET /api/uploadposts/total-impressions/{user}?platform=tiktok&breakdown=true` — total views per day
- **Per-post analytics**: `GET /api/uploadposts/post-analytics/{request_id}` — views, likes, comments for the specific carousel
- **Docs**: https://docs.upload-post.com
- **Script**: `publish-carousel.sh` handles publishing, `check-analytics.sh` fetches analytics

### Website Analysis — Playwright
- **Engine**: Playwright with Chromium for full JavaScript-rendered page scraping
- **Usage**: Navigates t
...[truncated 2981 chars]
Remediation
View remediation

Remediation Suggestions

  • Restrict website analysis to the exact public URLs approved by the user.
  • Disable automatic internal-page discovery by default and enforce same-origin, protocol, path, and page-count allowlists.
  • Block private, loopback, link-local, metadata-service, and internal-network destinations to reduce SSRF exposure in any future implementation.
  • Display the collected text, assets, and planned external recipients before transmission.
  • Redact personal information, authentication material, unpublished pricing, and other sensitive content from prompts and generated media.
  • Use narrowly scoped, revocable API credentials and never include tokens in URLs, logs, generated files, or model prompts.
  • Validate redirects so credentials or scraped content cannot be forwarded to unapproved hosts.
  • Require explicit approval before sending reference images to Gemini and before sending media to Upload-Post.
  • Add retention limits and deletion controls for analysis.json, post-info.json, slide images, captions, and analytics.
  • Include the referenced scripts in the package for review, or remove claims that they provide a verified secure implementation.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)

Exfiltration Commands

High
Category
Prompt Injection
Confidence
90% confidence
Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · AGENTS.md (reported line 148)May include surrounding context.

md
### Self-Optimizing Growth Loop
- **Performance Tracking**: Every post tracked via Upload-Post per-post analytics (`GET /api/uploadposts/post-analytics/{request_id}`) with views, likes, comments, shares
- **Pattern Recognition**: `learn-from-analytics.js` performs statistical analysis across post history to identify winning formulas
- **Recommendation Engine**: Generates specific, actionable suggestions stored in `learnings.json` for the next carousel
- **Schedule Optimization**: Reads `bestTimes` from `learnings.json` and adjusts cron schedule so next execution happens at peak engagement hour
- **100-Post Memory**: Maintains rolling history in `learnings.json` for long-term trend analysis

Missing User Warnings

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill describes autonomous research, direct posting to TikTok and Instagram, analytics retrieval, and accumulation of data in learnings.json, but it does not warn users about these capabilities or obtain explicit consent for them. This omission is dangerous because it can lead to unauthorized publishing, unexpected third-party data transfer, and persistent retention of potentially sensitive business or user-derived insights.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill explicitly instructs the agent to publish content and schedule future executions without any user warning or confirmation. This creates a direct unauthorized-action risk: an agent with connected social media, scheduler, or API credentials could perform externally visible actions and commit the user to ongoing automation without informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly directs fully autonomous daily publishing to public TikTok and Instagram accounts, including self-scheduling and zero human intervention, but provides no requirement for explicit user confirmation, approval gates, or impact warnings. In this context, the danger is unauthorized or unintended external actions on behalf of the user, which can cause reputational harm, policy violations, spam-like behavior, or account sanctions at scale.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill performs website scraping with Playwright and collects profile and post analytics, but it does not define data minimization, consent boundaries, retention limits, or handling rules for scraped content and engagement data. This is risky because the agent may collect, store, and reuse third-party or user-associated data in ways that create privacy, compliance, or terms-of-service exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill description explicitly states it can 'autonomously' generate content from any URL and 'publish' it to a feed, but provides no user-facing warning, consent boundary, or mention of review before posting. This is dangerous because users or orchestrating systems may invoke the skill without understanding it performs an external side effect, increasing the risk of unauthorized posting, reputational harm, or abuse via malicious input URLs.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The activation instruction is extremely broad and can cause the skill to be invoked in situations where the user did not clearly request autonomous content generation or publishing behavior. In a skill designed to research, generate, publish, and persist learnings without asking permission between steps, ambiguous activation materially increases the risk of unintended high-impact actions.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
95% confidence
Finding

The autonomous decision-making instruction is unsafe here because it is attached to a workflow that performs real external side effects, including research, generation, publishing, and scheduling. In this context, 'without asking' suppresses user oversight at exactly the points where account misuse, brand damage, unwanted spend, or repeated automated actions can occur.

Content

Scanner excerpt · SOUL.md (reported line 17)May include surrounding context.

md
- **JPG Only**: TikTok rejects PNG format for carousels

### Autonomy Standards
- **Zero Confirmation**: Run the entire pipeline without asking for user approval between steps
- **Auto-Fix Broken Slides**: Use vision to verify each slide; if any fails quality checks, regenerate only that slide with Gemini automatically
- **Notify Only at End**: The user sees results (published URLs), not process updates
- **Self-Schedule**: Read `learnings.json` bestTimes and schedule next execution at the optimal posting time

Static analysis

No suspicious patterns detected.