GetPost - The API Platform for Bots

• Outcome: Review
• Latest audit: May 29, 2026 · 9:26 PM UTC
• Version: 1.0.0

Overview

This skill is a coherent API reference, but it gives an agent access to broad paid and destructive actions without clear confirmation or safety boundaries.

Review this carefully before installing. Only use it with an API key you are comfortable giving broad paid authority to, keep the key out of prompts and logs, set spending limits where possible, and require manual confirmation before sending messages, buying credits, registering domains, changing DNS, creating labels, registering webhooks, or deleting resources.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The skill advertises powerful capabilities including messaging, scraping, AI generation, domain management, and shipping, but does not include any safety guidance about privacy, external transmissions, monetary cost, or irreversible operations. In an agent setting, this increases the risk that an autonomous system will invoke sensitive actions without informed user confirmation or appropriate guardrails.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The authentication section shows a live-key pattern and instructs users to save the key, but does not warn that the credential grants billable and sensitive access across many APIs. In a skill document consumed by agents or operators, normalizing direct handling of live secrets without storage and redaction guidance can lead to credential leakage and unauthorized use.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: This section documents domain registration, DNS changes, email provisioning, balance payments, and account deletion without cautionary warnings or confirmation requirements. These operations can create financial charges, disrupt infrastructure, or permanently remove resources, so presenting them as routine calls materially increases misuse risk in agentic workflows.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

- `GET /api/domains/:id/dns` — List DNS records
- `POST /api/domains/:id/dns` — Add/upsert DNS record (smart merge for SPF/DMARC)
- `PUT /api/domains/:id/dns/:recordId` — Update a DNS record
- `DELETE /api/domains/:id/dns/:recordId` — Delete a DNS record
- `POST /api/domains/:id/email` — Create email on your domain
- `POST /api/domains/:id/verify-email` — Verify email sending config
- Auto-provisions: Cloudflare DNS, nameservers, SendGrid email, default redirect

• Confidence: 89% confidence
• Finding: The documented DNS deletion endpoint enables high-impact changes to domain configuration, and the skill provides no constraints, validation guidance, or approval flow for using it. In an agent environment, parameter abuse or incorrect target selection could break email delivery, web hosting, verification records, or other domain-dependent services.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### Account
- `GET /api/auth/me` — Get your profile
- `PUT /api/auth/me` — Update name/bio
- `DELETE /api/auth/me` — Delete your account
- `GET /api/auth/rate-limits` — Check rate limit status

### Webhooks

• Confidence: 95% confidence
• Finding: The account deletion endpoint is an irreversible destructive action, yet the skill lists it without any warning, confirmation requirement, or anti-automation safeguard. An agent could accidentally or maliciously trigger permanent account loss, potentially deleting access to paid services, history, and associated resources.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

- `POST /api/webhooks` — Register `{"url", "events"}`
- `GET /api/webhooks` — List your webhooks
- `GET /api/webhooks/deliveries` — View delivery history (status, latency, errors)
- `DELETE /api/webhooks/:id` — Delete a webhook
- Events: `email.received`, `sms.received`, `balance.low`, `balance.credited`, `generation.completed`, `*` (all)

### Logs

• Confidence: 83% confidence
• Finding: Webhook deletion is a state-changing administrative action that can silently disable integrations, event delivery, or monitoring. Because the skill presents the endpoint without approval or validation guidance, an agent may remove critical webhooks through mistaken parameters or untrusted instructions.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.