Social Media Automator

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:15 PM UTC
• Version:
  1.2.0

Overview

This is a social-post drafting skill with disclosed scheduling-oriented output and package-install notes, but no evidence of hidden execution, credential access, automatic posting, or destructive behavior.

Use this as a drafting and repurposing aid, not an unattended publisher. Review generated posts for accuracy, rights, tone, and platform policy before scheduling or posting, and only approve npm installs or social-account integrations if you trust them and intend to use those platforms.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill advertises scheduling and publish-ready output formats, which can encourage unattended or insufficiently reviewed posting. In a social media automation context, this raises the risk of publishing inaccurate, inappropriate, copyrighted, or policy-violating content at scale before a human validates it.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The manifest description is broad enough that an orchestrator could invoke this skill for loosely related requests about articles, social posts, or marketing without clear user intent to use this specific automation. Over-broad trigger language increases the risk of unintended activation, causing unnecessary data exposure to the skill and unexpected automated actions in content workflows.

VirusTotal

65/65 vendors flagged this skill as clean.