Security audit
Security checks for vulnerabilities and agentic risk
Review is needed because Google Business reporting automatically collects broader business activity than the promised post-engagement metrics.
Use a dedicated posts folder and protect the generated reports. Before using Google Business analytics, request an explicit opt-in and a separately labeled location report; the current behavior collects broader business activity automatically and can misrepresent it as individual post performance. Existing social sign-ins are used. The separate core dependency and live API behavior were not assessed.
Referenced artifact was not completely inspected
2. Run `node scripts/analytics.mjs --root <folder>`. It writes `report.md` and `report.json`.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
function defaultHint(error) {
switch (error.code) {
case 190:
return "The access token is expired or invalid. Re-run the auth script for this platform.";
case 4:
case 17:
case 32:
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
onError: (status, body) => new PlatformError(
`MASTODON_${status}`,
String(body.error ?? `Mastodon API error ${status}`),
status === 401 || status === 403 ? "The access token is invalid or lacks write:statuses / write:media." : void 0
)
});
}
Without declared permissions the skill's intent is opaque and cannot be validated.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
return v;
}
function apiBase(env) {
return env[PIN_ENV.sandbox] === "1" ? "https://api-sandbox.pinterest.com/v5" : "https://api.pinterest.com/v5";
}
function basic(env) {
return {
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
"pinterest",
async (t) => toToken2(
await postForm(
"https://api.pinterest.com/v5/oauth/token",
{ grant_type: "refresh_token", refresh_token: t.refreshToken },
basic(env)
),
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
async function call(token, method, body, fetchImpl) {
const isForm = body instanceof FormData;
const res = await fetchWithRetry(
`https://api.telegram.org/bot${token}/${method}`,
{
method: "POST",
body: isForm ? body : JSON.stringify(body),
The Google Business metrics implementation retrieves 30 days of location-wide impressions, website clicks, calls, and direction requests rather than engagement attributable to the recorded post. This exceeds the skill's stated post-engagement scope and writes broader business activity into the report without an explicit opt-in; repeating those totals for each post also makes the report misleading. Existing API authorization limits which locations are accessible, but does not establish consent for this broader collection.