Security audit

schedulala

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for managing social posts, but it asks agents to install mutable npm tools and handle account-linked publishing credentials, so users should review it before enabling.

Install only if you intend to use Schedulala for account-linked social publishing. Prefer pinned package versions, avoid placing real app passwords or bot tokens in chat or command arguments, use test keys or drafts first, and require explicit confirmation before any post, reply, hide, or bulk action.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:62
Finding: Unpinned npm Packages Are Downloaded and Executed
Content: View full analysis
` (no install) or `npm install -g schedulala`. ``` From `references/connector-widgets.md:33`: ```markdown - The same core tools without widgets are available locally via `npx -y @schedulala/mcp-server` (env: `SCHEDULALA_API_KEY`, optional `SCHEDULALA_API_URL`) for Claude Desktop, Claude Code, and Cursor. ``` ### Technical Analysis The installation and execution instructions do not pin `schedulala` or `@schedulala/mcp-server` to a reviewed version. They also provide no package-lock file, registry restriction, integrity hash, provenance validation, or signature-veri ...[truncated 2150 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:124
Finding: Social-Account Credentials May Be Exposed Through Command-Line Arguments
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (9)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The invocation description is extremely broad and overlaps with many routine social-media tasks, increasing the chance the agent will select this skill automatically in situations where it is not necessary. Since the skill then encourages installation and external connectivity, broad triggering increases the risk of unnecessary code execution, API-key use, and unintended posting actions.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The audience instruction tells the agent to install and connect Schedulala whenever the user points it at the file, effectively encouraging automatic tool execution based on untrusted content. This weakens the normal trust boundary: merely referencing the skill file can cause package installation and account-linked actions before the agent has established that such actions are necessary and authorized.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The skill instructs the agent to install and execute the unpinned npm package schedulala via npx -y schedulala, which implicitly trusts the latest package version at runtime. If the package is compromised, typosquatted, or a malicious update is published, the agent may execute attacker-controlled code with the agent's shell privileges and access to sensitive environment variables such as SCHEDULALA_API_KEY.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.
md
minutes; codes expire in 15) and saves the key to `~/.schedulala/config.json`. With `--json`, init emits TWO JSON documents on stdout (first the code + URL, later the completion) — parse them as a stream, never JSON.parse the whole output. Never ask the user to paste credentials into the chat. **What a fresh key gets** (free taster): 2 connected accounts, **4 posts total — lifetime, never resets**, 30 requests/min, no posting to X/Twitter

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The skill recommends running npx -y @schedulala/mcp-server without a pinned version, causing the agent to fetch and execute whatever version is current at the time of use. In an MCP context this is especially risky because the server can shape tool behavior and may gain access to secrets, filesystem context, and downstream actions through the agent integration.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: This is a second unpinned execution path for @schedulala/mcp-server, again allowing arbitrary future package updates to alter executed code without user review. Because the skill is designed for broad social-media workflow automation and may be invoked in many contexts, the exposure surface is widened and a malicious package update could affect a large set of common user requests.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The documentation instructs users to run the package via npx schedulala without pinning an exact version. That causes execution of whatever package version is current at invocation time, so a compromised maintainer account, poisoned release, or typo/package-swap event could lead to arbitrary code execution on the user's machine. In this skill's context, that risk is more significant because the tool handles API keys and social-account publishing workflows, increasing the blast radius of a malicious package release.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The documentation instructs users to run npx -y @schedulala/mcp-server without pinning an exact package version. That causes execution of whatever package version is current at install time, which creates a supply-chain risk: a compromised newly published version, malicious dependency update, or unexpected breaking change could be fetched and executed automatically. In this skill's context, the command is especially sensitive because it is meant to be run by agent users in local environments with API credentials (SCHEDULALA_API_KEY) available.
Content: No source excerpt is available for this finding.

Behavior Manipulation

Medium

Category: Prompt Injection
Confidence: 75% confidence
Finding: Subtle instructions detected that may alter agent decision-making or introduce hidden biases.
Content: Scanner excerpt · references/media.md (reported line 20)May include surrounding context.
md
zone) IN the conversation — drag-and-drop or file picker, multiple files at once for carousels. The file goes browser → S3 through a ticket-authenticated presigned upload; the bytes never touch the model or the MCP transport, so quality is preserved end-to-end. Never tell the user the widget doesn't exist there. - **No widget rendering (Cursor, self-hosted agents, custom clients):** the tool still works — its result carries a complete programmatic upload API in

Static analysis

No suspicious patterns detected.