X Post Strategist

• Outcome: Pass
• Latest audit: Jun 23, 2026 · 10:23 AM UTC
• Version: 0.14.0

Overview

This is a disclosed X drafting skill with optional local image rendering and opt-in draft saving, and I did not find artifact-backed malicious behavior.

Before installing, be comfortable with a writing skill that may use web search on the topic text you provide, can optionally install/use Puppeteer and launch local Chrome to render text/data graphics, and can save drafts only after you opt in. Keep render HTML self-contained, review the resolved save path, and avoid custom Chrome flags unless needed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 82% confidence
• Finding: The skill relies on environment-derived behavior (`OBSIDIAN_VAULT_PATH`) without declaring corresponding permissions, which creates hidden capability scope and weakens least-privilege review. Undeclared env access can expose sensitive local paths or enable writes to unintended locations when combined with the vault-save workflow.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill's declared purpose is X-post drafting, but it also instructs rendering HTML/CSS to images and launching headless Chrome/Chromium via helper scripts. This expands execution and local-system interaction well beyond user expectations, increasing attack surface through browser automation, local executable discovery, and file generation that are not clearly disclosed in the skill description.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The skill claims it will not auto-post, but it introduces persistent note-vault writing and automatic saving across the session, which is unrelated to merely drafting X content. Persistent writes create data-handling risk, can leak sensitive draft material into local stores, and may surprise users who did not expect filesystem side effects from a writing assistant.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The skill resolves filesystem targets from user input or environment variables and instructs direct file creation/appending under absolute paths, which is broader access than necessary for post drafting. If misused, this can write content into unintended locations, reveal directory structure, or enable path manipulation through overly permissive save flows.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The script claims no network access is required, but it loads attacker-controlled HTML in a real browser and waits for `networkidle0`, which allows external subresources such as images, fonts, CSS, and scripts referenced by the HTML to be fetched. In a skill that renders generated content, this can leak environment information, trigger unintended outbound requests, or execute active web content during rendering, making the comment materially misleading and the behavior unsafe by default.

Context-Inappropriate Capability

Low

• Confidence: 82% confidence
• Finding: Accepting arbitrary Chrome launch flags from `RENDER_CHROME_ARGS` broadens the browser's execution surface beyond what this renderer needs and can silently weaken security assumptions, for example by disabling protections or enabling extra capabilities. While this requires local control of the environment, it makes the script easier to run in an unsafe configuration and complicates trust in its security posture.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"node": ">=18"
  },
  "dependencies": {
    "puppeteer": "^24.15.0"
  }
}

• Confidence: 92% confidence
• Finding: "puppeteer": "^24.15.0"

VirusTotal

63/63 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.