Security audit

Postiz Extended

Security checks across malware telemetry and agentic risk

Overview

This is a real social-posting helper, but it ships hardcoded Postiz credentials and can act on a specific social media account.

Review before installing. Only use this if you intentionally control the referenced Postiz instance and connected social accounts. Rotate the exposed password, revoke existing sessions, remove hardcoded credentials, make the host/account/integration IDs user-configurable, and store any session cookies in a user-private secure location or avoid persisting them.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 85% confidence
Finding: The skill clearly instructs use of shell commands, network access, and cookie/file writes, yet it declares no permissions. This creates a transparency and consent problem: an agent or user may invoke the skill without understanding that it will perform authenticated network operations and write session data locally.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill description overstates capabilities and hides important operational constraints, including that it is bound to a specific Postiz deployment with hardcoded integrations and credentials. This mismatch can mislead users or downstream agents into sending content to the wrong environment, assuming unsupported safety checks exist, or relying on functions that are not actually implemented.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The authentication example exposes a real email address and plaintext password in the skill file. Anyone with access to the skill can reuse these credentials to log into the referenced Postiz instance, access connected social accounts, schedule or delete posts, and potentially pivot into other linked services.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The script hardcodes a real-looking Postiz account email and password, then automatically authenticates to a live service. Embedding reusable credentials in source code exposes account access to anyone who can read the file, enables unauthorized posting or data access, and is far beyond what a harmless duplicate-check helper should do without explicit secure secret handling.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The script embeds a real Postiz email/password pair directly in source code, which exposes credentials to anyone who can read the file and enables unauthorized access to the linked social media management account. In the context of a posting skill, this is especially dangerous because compromise could let an attacker publish, modify, or inspect scheduled content across multiple connected channels.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The script stores authenticated session cookies in a predictable world-accessible temporary path under /tmp, which can expose reusable session material to other local users or processes on the host. Because the session grants access to a social posting backend, theft of this cookie file may allow account takeover without needing the password.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The authentication instructions both expose credentials and normalize insecure handling of session material by storing cookies in a predictable local file without any warning. This increases the chance of credential theft, session hijacking, accidental logging, or reuse by other local processes/users.

Missing User Warnings

Medium

Confidence: 78% confidence
Finding: The skill provides a direct DELETE call for posts without any confirmation step or warning that the operation is irreversible. In an agent-driven context, this raises the risk of accidental destructive actions against scheduled or published content if the command is followed automatically or copied without review.

Missing User Warnings

High

Confidence: 99% confidence
Finding: Sensitive credentials are embedded directly in the script and used silently for authentication, with no disclosure to the user. This creates a high risk of secret leakage through source control, logs, backups, or redistribution of the skill, and it can grant unauthorized access to the associated Postiz account and connected social media workflows.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The script persists authenticated session cookies to /tmp/postiz-cookies.txt without warning, which can expose active session material to other local users, processes, backups, or accidental reuse. Because cookies may bypass password prompts, theft of this file could allow unauthorized access to the Postiz account until the session expires or is revoked.

Natural-Language Policy Violations

Medium

Confidence: 97% confidence
Finding: Hard-coding a specific account identity forces all use through one visible personal account and removes user choice, which can lead to accidental posting under the wrong identity and reveals operational account details. Combined with the embedded password, this materially increases the risk because the account is not only identifiable but directly usable by anyone with the script.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.