Postproxy

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 10:09 AM UTC
• Version: 2.0.2

Overview

This skill is a clearly documented Postproxy API helper for managing real social media accounts, with sensitive actions disclosed and confirmation guidance included.

Install only if you trust Postproxy with the connected social accounts and API key. Confirm exact targets before publishing, deleting, moderating, sending DMs, creating queues, or registering webhooks; pin installation and SDK versions where possible, and harden webhook verification with timestamp freshness and duplicate-delivery checks.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: README.md:24

Finding

Unpinned executable installation introduces supply-chain risk

Content

View full analysis

Remediation

View remediation

...`. - Pin the Skill to an immutable release, content digest, or commit hash if supported. - Publish and verify checksums or signatures for release artifacts. - Document the canonical package owner and repository so users can detect namespace confusion. - Recommend inspecting the resolved package and Skill source before installation. - Use lockfile-backed or otherwise reproducible installation procedures where possible. - Require explicit user approval before an agent runs package installation commands. ]]>

T08 · Insecure Dependencies

Warning

• Location: rules/sdks.md:5

Finding

Official SDK installation examples lack version and integrity pinning

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: rules/webhooks.md:75

Finding

Webhook signature examples do not prevent replay and may throw on malformed Node.js signatures

Content

View full analysis

p.split("=", 2)) ); const signedPayload = `${parts.t}.${payload}`; const computed = crypto .createHmac("sha256", secret) .update(signedPayload) .digest("hex"); return crypto.timingSafeEqual(Buffer.from(computed), Buffer.from(parts.v1)); } ``` ```python import hmac, hashlib def verify_webhook(payload: str, signature_header: str, secret: str) -> bool: parts = dict(p.split("=", 1) for p in signature_header.split(",")) signed_payload = f"{parts['t']}.{payload}" computed = hmac.new( secret.encode(), signed_payload.encode(), hashlib.sha256 ).hexdigest() return hmac.compare_digest(computed, parts["v1"]) ``` ### Technical Analysis Both examples include the supplied timestamp in the HMAC input but do not check whether that timestamp is recent. A valid signed request captured in transit, endpoint logs, observability systems, or another compromised component can therefore be replayed indefinitely while retaining a valid signature. The examples also do not implement idempotency using the `X-Postproxy-Delivery` identifier documented elsewhere in the file. Even with a timestamp tolerance, duplicate deliveries inside the accepted window could trigger repeated processing. In the Node.js example, `crypto.timingSafeEqual` requires buffers of equal length. The code does not validate the format or length of `parts.v1` before comparison. A malformed or missing digest can cause an exception rather than a controlled authentication failure. If the receiving application does not catch this exception, repeated malformed requests could gener ...[truncated 1599 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (83)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.

md

This skill publishes to, modifies, and deletes content on the user's real social media accounts, and can read/send private messages. Before any outward-facing or irreversible action, summarize exactly what will happen and get explicit user confirmation:

- **Publishing** (create post without `draft`, publish draft, comment, reply): content goes live publicly and immediately. State the exact text, media, and target profiles/placements first. Prefer creating a draft when intent is ambiguous.
- **Deleting**: deleting a post from the DB only (`DELETE /api/posts/{id}`) leaves it live on the platforms; `delete_on_platform=true` or `/delete_on_platform` removes it from the social networks **irreversibly**. Never delete on platform without the user explicitly confirming the post and scope.
- **Direct messages and private replies**: these are private communications with real people. Only read or send them when the user explicitly asks; don't quote DM contents into other posts, tools, or external services. Private replies bypass Meta's 24h window — confirm before initiating contact.
- **Placements**: when posting to Facebook without an explicit placement, the post goes to a **random connected page**; LinkedIn defaults to the personal profile. Always resolve and confirm the placement for placement networks.
- **Webhook secrets**: the `secret` returned when creating a webhook is a credential — never print it in output, log it, or commit it. Webhook payloads can contain private content (DMs, comments) and are sent to the configured URL — only register HTTPS endpoints the user controls and trusts.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · README.md (reported line 286)May include surrounding context.

md

- **Confirm before going public or irreversible** — publishing posts/comments, sending DMs, and deleting content on platforms require summarizing the action (content, targets, scope) and getting explicit user confirmation first. Drafts are preferred when intent is unclear.
- **Distinguish deletion modes** — removing a post from Postproxy's DB leaves it live on the platforms; deleting *on platform* is irreversible.
- **Protect private communications** — DM contents are only read/sent on explicit request and never forwarded to other tools or services without consent. Private replies initiate contact outside Meta's 24h window and require confirmation.
- **Protect credentials** — the API key and webhook secrets are never logged, echoed, or committed. Webhook payloads can include private content, so only user-controlled HTTPS endpoints should be registered.
- **Pin placements** — Facebook posts without an explicit placement go to a random connected page, so placements are always resolved and confirmed first.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

md

env:
        - POSTPROXY_API_KEY
      bins:
        - curl
    envVars:
      - name: POSTPROXY_API_KEY
        required: true

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · rules/comments.md (reported line 26)May include surrounding context.

List Comments

Retrieves paginated top-level comments for a published post. Each top-level comment includes a flat replies array.

bash

curl -X GET "https://api.postproxy.dev/api/posts/{post_id}/comments?profile_id={profile_id}&page=0&per_page=20" \
  -H "Authorization: Bearer $POSTPROXY_API_KEY"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The hide/unhide endpoints perform real moderation actions on external platforms, but the documentation lacks any warning to confirm intent or explain the visibility impact. An agent following these rules could silently suppress or re-expose user-generated content on behalf of a brand, causing moderation mistakes, reputation harm, or policy violations.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · rules/comments.md (reported line 173)May include surrounding context.

List Profile Comments

Retrieves reviews scoped to a profile (and optionally a placement/location). Each top-level comment includes a flat replies array.

bash

curl -X GET "https://api.postproxy.dev/api/profiles/{profile_id}/comments?placement_id={location_path}&page=0&per_page=20" \
  -H "Authorization: Bearer $POSTPROXY_API_KEY"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The profile-comment delete operation removes the business's reply from Google Business, but unlike post comment deletion it lacks a strong irreversibility and confirmation warning. An agent could therefore delete a published business response without sufficient user verification, leading to loss of customer communication and reputational impact.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · rules/messages.md (reported line 26)May include surrounding context.

List Chats

Returns paginated chats for a profile, ordered by last_message_at descending.

bash

curl -X GET "https://api.postproxy.dev/api/profiles/{profile_id}/chats?page=0&per_page=20" \
  -H "Authorization: Bearer $POSTPROXY_API_KEY"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · rules/posts.md (reported line 7)May include surrounding context.

List Posts

bash

curl -X GET "https://api.postproxy.dev/api/posts" \
  -H "Authorization: Bearer $POSTPROXY_API_KEY"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · rules/posts.md (reported line 149)May include surrounding context.

Update Post

Updates an existing post. Only drafts and scheduled posts more than 5 minutes before publish time can be updated. All body fields are optional — only send what you want to change.

bash

curl -X PATCH "https://api.postproxy.dev/api/posts/{id}" \
  -H "Authorization: Bearer $POSTPROXY_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

List Profiles

bash

curl -X GET "https://api.postproxy.dev/api/profiles" \
  -H "Authorization: Bearer $POSTPROXY_API_KEY"

Optional query parameter: profile_group_id to filter by profile group.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

List Profiles

bash

curl -X GET "https://api.postproxy.dev/api/profiles" \
  -H "Authorization: Bearer $POSTPROXY_API_KEY"

Optional query parameter: profile_group_id to filter by profile group.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

List Profiles

bash

curl -X GET "https://api.postproxy.dev/api/profiles" \
  -H "Authorization: Bearer $POSTPROXY_API_KEY"

Optional query parameter: profile_group_id to filter by profile group.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · rules/analytics.md (reported line 8)May include surrounding context.

List Profiles

bash

curl -X GET "https://api.postproxy.dev/api/profiles" \
  -H "Authorization: Bearer $POSTPROXY_API_KEY"

Optional query parameter: profile_group_id to filter by profile group.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · rules/comments.md (reported line 26)May include surrounding context.

List Profiles

bash

curl -X GET "https://api.postproxy.dev/api/profiles" \
  -H "Authorization: Bearer $POSTPROXY_API_KEY"

Optional query parameter: profile_group_id to filter by profile group.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · rules/comments.md (reported line 39)May include surrounding context.

List Profiles

bash

curl -X GET "https://api.postproxy.dev/api/profiles" \
  -H "Authorization: Bearer $POSTPROXY_API_KEY"

Optional query parameter: profile_group_id to filter by profile group.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · rules/comments.md (reported line 48)May include surrounding context.

List Profiles

bash

curl -X GET "https://api.postproxy.dev/api/profiles" \
  -H "Authorization: Bearer $POSTPROXY_API_KEY"

Optional query parameter: profile_group_id to filter by profile group.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · rules/comments.md (reported line 58)May include surrounding context.

List Profiles

bash

curl -X GET "https://api.postproxy.dev/api/profiles" \
  -H "Authorization: Bearer $POSTPROXY_API_KEY"

Optional query parameter: profile_group_id to filter by profile group.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · rules/comments.md (reported line 76)May include surrounding context.

List Profiles

bash

curl -X GET "https://api.postproxy.dev/api/profiles" \
  -H "Authorization: Bearer $POSTPROXY_API_KEY"

Optional query parameter: profile_group_id to filter by profile group.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · rules/comments.md (reported line 82)May include surrounding context.

List Profiles

bash

curl -X GET "https://api.postproxy.dev/api/profiles" \
  -H "Authorization: Bearer $POSTPROXY_API_KEY"

Optional query parameter: profile_group_id to filter by profile group.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · rules/comments.md (reported line 88)May include surrounding context.

List Profiles

bash

curl -X GET "https://api.postproxy.dev/api/profiles" \
  -H "Authorization: Bearer $POSTPROXY_API_KEY"

Optional query parameter: profile_group_id to filter by profile group.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · rules/comments.md (reported line 94)May include surrounding context.

List Profiles

bash

curl -X GET "https://api.postproxy.dev/api/profiles" \
  -H "Authorization: Bearer $POSTPROXY_API_KEY"

Optional query parameter: profile_group_id to filter by profile group.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · rules/comments.md (reported line 100)May include surrounding context.

List Profiles

bash

curl -X GET "https://api.postproxy.dev/api/profiles" \
  -H "Authorization: Bearer $POSTPROXY_API_KEY"

Optional query parameter: profile_group_id to filter by profile group.

Static analysis

No suspicious patterns detected.