Your LinkedIn & Twitter Assistant by Reepl

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:19 PM UTC
• Version: 1.3.1

Overview

The skill is mostly coherent for managing social posts, but it asks users to place a powerful Reepl API key in an MCP URL query string for an integration that can publish, schedule, delete, and read account content.

Review this before installing if you are comfortable giving Reepl MCP broad access to manage LinkedIn and connected Twitter/X content. Prefer secret/env-based credential handling if supported, avoid sharing logs or screenshots containing the configured MCP URL, and require explicit approval before any publish, comment, schedule, delete, or profile-update action.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:26

Finding

API Credential Exposed in MCP Endpoint Query String

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 26–29
Vulnerability Type: API credential exposure through a URL query parameter
Risk Level: Medium

text

# 3. Copy the API key shown after authorization

# 4. Configure the MCP server endpoint
https://mcp.reepl.io/mcp?key=YOUR_API_KEY

Technical Analysis

The setup instructions require placing the Reepl API key in the MCP endpoint's URL query string. Although HTTPS protects the URL in transit, query strings are commonly retained in MCP client configuration, browser or client history, application logs, reverse-proxy access logs, monitoring and telemetry systems, screenshots, and diagnostic output.

An API key should be treated as a bearer credential. Embedding it in a URL creates unnecessary opportunities for disclosure compared with a secret-specific authentication channel such as an HTTP Authorization header. This behavior is not required for the Skill's declared functionality; authentication can be implemented without including the credential in the endpoint URL.

Attack Path

1. A user completes OAuth authorization and receives a Reepl API key.
2. Following the documented setup, the user inserts that key into the MCP endpoint query string.
3. The complete URL is persisted or captured by a client configuration file, access log, telemetry event, screenshot, support bundle, or other diagnostic output.
4. An attacker or unauthorized internal party obtains access to that retained data.
5. The attacker extracts the API key and authenticates to Reepl's MCP endpoint.
6. Subject to the key's server-side scope and connected integrations, the attacker invokes available Reepl operations under the victim's identity.

Impact Assessment

A leaked key may permit unauthorized access to data and actions exposed by the Reepl MCP integration. The documented tools include access to the user's profile and email address, voice profile, LinkedIn contacts ...[truncated 497 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the API key from the MCP endpoint query string.
2. Authenticate using Authorization: Bearer <key> or an equivalent MCP-supported secret transport mechanism.
3. Read REEPL_MCP_KEY from protected environment or secret storage and ensure it is never interpolated into a logged URL.
4. Redact credentials from application logs, proxy logs, telemetry, error reports, and support bundles.
5. Store configuration files containing secrets with restrictive filesystem permissions and exclude them from source control and backups where possible.
6. Issue narrowly scoped, short-lived credentials where supported, with separate permissions for read and destructive or publishing operations.
7. Provide documented key revocation and rotation procedures, and rotate any keys previously placed in URLs.
8. Preserve the existing explicit-confirmation requirement for publishing while also enforcing authorization and confirmation controls server-side.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.