SocialKit Threads Post

• Outcome: Pass
• Latest audit: Nov 6, 2026 · 7:11 AM UTC
• Version: 0.3.1

Overview

The skill publishes approved Threads posts with proportionate credential access and no hidden behavior found in the bundled files.

Review the two prerequisite skills separately. Use only the Threads setup sections; Facebook and Instagram authorization is unnecessary for this workflow. Protect the local credential files and approve the exact post before publishing. Media URLs must be publicly accessible. All bundled files were reviewed, but prerequisite authentication and approval implementations were unavailable.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 84% confidence

Finding

Threads authentication is a reasonable supporting implementation detail for publishing to Threads. The separate Facebook authentication commands introduce an additional platform capability with no stated connection to the declared purpose. The supplied chunk does not demonstrate publishing, validation, or approval, but their absence from this setup excerpt is not itself evidence of a mismatch.

Content

No source excerpt is available for this finding.

Incomplete referenced artifact analysis

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md

3. `node scripts/publish.mjs --check --dir th-<slug>`

Incomplete referenced artifact analysis

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

md

5. `node scripts/publish.mjs --publish --dir th-<slug>`. Report the permalink.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 29)May include surrounding context.

md

1. https://developers.facebook.com/apps > Create app > type **Business**.
2. Add **Facebook Login for Business**. Under its settings add your redirect URL to
   **Valid OAuth Redirect URIs** (exact match, Strict Mode on).
3. Optional but recommended: create a Login configuration (User access token) with the
   permissions below, and set its ID as `META_LOGIN_CONFIG_ID`. Without it the auth script
   requests the permissions by scope.
4. Permissions used: `pages_show_list`, `pages_read_engagement`, `pages_manage_posts`,

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/publish.mjs (reported line 553)May include surrounding context.

js

function defaultHint(error) {
  switch (error.code) {
    case 190:
      return "The access token is expired or invalid. Re-run the auth script for this platform.";
    case 4:
    case 17:
    case 32:

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, network.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.