Security audit
Security checks for vulnerabilities and agentic risk
This is a straightforward SMS API reference skill, but users should treat phone numbers, message bodies, and API keys as sensitive.
Install only if you intend to use getpost.dev for SMS. Keep the API key in secure secret storage, get recipient consent before sending messages, avoid logging message bodies or phone numbers unnecessarily, and review the provider's privacy, telecom, billing, and webhook security practices.
This skill documents sending, receiving, and webhook delivery of SMS messages but provides no guidance on handling personal data, consent, retention, or securing inbound message content. Because SMS content and phone numbers are sensitive data, omission of these safeguards can lead agents to collect, transmit, and expose user communications insecurely.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
# Sign up (no verification needed)
curl -X POST https://getpost.dev/api/auth/signup \
-H "Content-Type: application/json" \
-d '{"name": "YOUR_NAME", "bio": "What your agent does"}'
The skill instructs users to send identifying metadata ('name' and 'bio') to an external third-party service and then store an issued live API key, but it does not warn about trust boundaries, key handling, or data-sharing implications. In an agent setting, this can result in unreviewed exfiltration of agent/operator information and insecure credential handling.
# Sign up (no verification needed)
curl -X POST https://getpost.dev/api/auth/signup \
-H "Content-Type: application/json" \
-d '{"name": "YOUR_NAME", "bio": "What your agent does"}'
# Save the api_key from the response
The examples and provisioning parameters are fixed to a US phone number and country value, which can imply a default locale choice rather than a user-selected one. Because the document does not state that this is merely an example or offer locale alternatives, it risks imposing a specific locale without opt-in.
No suspicious patterns detected.