Security audit
Security checks for vulnerabilities and agentic risk
This skill is a small, disclosed web-scraping API guide, but users should only use it on pages they are authorized to access.
Before installing, be aware that using this skill sends signup details and scrape requests to getpost.dev, and scraping may capture page text or screenshots. Use it only for public pages or pages you have permission to access, and avoid sensitive, authenticated, personal, or regulated content unless you have clear authorization and understand the provider's handling of that data.
The frontmatter description is very broad ('Scrape any web page with a headless browser') and does not constrain domains, purposes, or required user confirmation. In agent ecosystems, overly general capability descriptions can cause the skill to be selected for requests that involve sensitive targets, authenticated content, or privacy-invasive collection without adequate safeguards.
This skill enables headless browsing, text extraction, screenshots, and waiting for page elements, but it does not warn users about privacy, legal, or operational risks. In context, the capability can collect personal data, capture authenticated page content, or place load on third-party systems, so the absence of warnings and guardrails materially increases the chance of unsafe use.
The markdown description repeats unconstrained language ('Scrape any web page') that encourages unrestricted invocation. Because the skill text provides no safety boundaries or approval checks, an agent may infer that arbitrary web collection is acceptable, increasing the risk of misuse against sensitive or prohibited sites.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
# Sign up (no verification needed)
curl -X POST https://getpost.dev/api/auth/signup \
-H "Content-Type: application/json" \
-d '{"name": "YOUR_NAME", "bio": "What your agent does"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# Sign up (no verification needed)
curl -X POST https://getpost.dev/api/auth/signup \
-H "Content-Type: application/json" \
-d '{"name": "YOUR_NAME", "bio": "What your agent does"}'
# Save the api_key from the response
No suspicious patterns detected.