Security audit
Security checks for vulnerabilities and agentic risk
Review is needed because approval does not lock all reply destinations and account details, and the script supports additional platforms beyond those advertised.
Ask the publisher to make approval cover reply text, platform, destination and sending account, and to require explicit opt-in for additional platforms before enabling sends. Use a dedicated posts folder and keep the inbox private, then delete it when finished. Manual inspection addressed material gaps in the partial scanner report, but separate core and authentication skills were unavailable for review. The evidence supports an approval and scope concern, not intentional theft or malicious behavior.
Referenced artifact was not completely inspected
1. Fetch: `node scripts/inbox.mjs --fetch --root <posts folder> --inbox <inbox folder>`
Referenced artifact was not completely inspected
terminal: `node scripts/inbox.mjs --approve --inbox <inbox folder>`
Referenced artifact was not completely inspected
5. Send: `node scripts/inbox.mjs --send --inbox <inbox folder>`. Already-sent replies are
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
function defaultHint(error) {
switch (error.code) {
case 190:
return "The access token is expired or invalid. Re-run the auth script for this platform.";
case 4:
case 17:
case 32:
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
onError: (status, body) => new PlatformError(
`MASTODON_${status}`,
String(body.error ?? `Mastodon API error ${status}`),
status === 401 || status === 403 ? "The access token is invalid or lacks write:statuses / write:media." : void 0
)
});
}
Approval hashes only replies.json, while sending resolves the platform, destination, and author from the unhashed comments.json. An attacker or agent able to modify that file after approval can preserve an approved commentId while changing its destination or platform, causing an authenticated reply somewhere the user did not approve.
Without declared permissions the skill's intent is opaque and cannot be validated.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
## Rules
- Never reply on the user's behalf without approval, and never send replies that make
promises, give refunds, or share personal details unless the user wrote that wording.
- Replying on YouTube is not supported (it needs an extra Google permission); list those
comments for the user to answer in YouTube Studio.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
return v;
}
function apiBase(env) {
return env[PIN_ENV.sandbox] === "1" ? "https://api-sandbox.pinterest.com/v5" : "https://api.pinterest.com/v5";
}
function basic(env) {
return {
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
"pinterest",
async (t) => toToken2(
await postForm(
"https://api.pinterest.com/v5/oauth/token",
{ grant_type: "refresh_token", refresh_token: t.refreshToken },
basic(env)
),
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
async function call(token, method, body, fetchImpl) {
const isForm = body instanceof FormData;
const res = await fetchWithRetry(
`https://api.telegram.org/bot${token}/${method}`,
{
method: "POST",
body: isForm ? body : JSON.stringify(body),
The fetch loop dispatches to any registered platform found in publication history rather than restricting itself to the platforms advertised by this skill, including Google Business Profile, Bluesky, and Mastodon. When corresponding credentials and publication records exist, this expands data collection and potential authenticated replies beyond the stated scope; interactive reply approval limits, but does not eliminate, that risk.