Security audit

PostPlanify

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed PostPlanify integration for managing social media content, with expected but sensitive posting, upload, analytics, reply, and delete capabilities.

Install only if you use PostPlanify and are comfortable letting the agent act through your API key. Review all account, caption, media, time, reply, cancel, and delete confirmations carefully, and use the least-privileged PostPlanify key available because actions can publish publicly or permanently remove remote content.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (15)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 96% confidence
Finding: The skill exposes a permanent deletion operation for posts, which can be highly destructive if the agent selects the wrong ID, is prompt-injected, or acts without sufficiently specific user approval. Although the documentation says to confirm destructive actions, the capability itself is dangerous because deletion is irreversible and affects public publishing records.
Content: Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.
md
| List posts | `GET /posts?workspaceId=...` with optional `status`, `platform`, `socialAccountId`, `from`, `to`, `includeMetrics=true`, `page`, `limit` (max 100) | | Edit a scheduled post | `PATCH /posts/{id}` with only the fields to change (`caption`, `scheduledAt`, platform params) | | Cancel (keep it, stop publishing) | `POST /posts/{id}/cancel` | | Delete permanently | `DELETE /posts/{id}` | | Delete uploaded media | `DELETE /media/{id}` | | Pinterest boards | `GET /social-accounts/{id}/pinterest-boards` | | Workspace analytics (last 7 days) | `GET /analytics/{workspaceId}/overview` |

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: The skill allows permanent deletion of uploaded media, creating a destructive tool-use path that could remove assets needed for campaigns or compliance records. If parameter selection is manipulated or ambiguous, the agent could delete the wrong media object with no easy recovery.
Content: Scanner excerpt · SKILL.md (reported line 134)May include surrounding context.
md
| Edit a scheduled post | `PATCH /posts/{id}` with only the fields to change (`caption`, `scheduledAt`, platform params) | | Cancel (keep it, stop publishing) | `POST /posts/{id}/cancel` | | Delete permanently | `DELETE /posts/{id}` | | Delete uploaded media | `DELETE /media/{id}` | | Pinterest boards | `GET /social-accounts/{id}/pinterest-boards` | | Workspace analytics (last 7 days) | `GET /analytics/{workspaceId}/overview` | | One account's analytics | `GET /analytics/{workspaceId}/{socialAccountId}` |

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 91% confidence
Finding: The documented DELETE /posts/{id} endpoint permanently removes posts and is irreversible, creating a high-risk primitive if an agent can be influenced into supplying a user-controlled or mistaken post ID. In this skill context, where users manage many scheduled posts across workspaces, parameter misuse or prompt injection could cause loss of planned content and operational disruption.
Content: Scanner excerpt · references/api-reference.md (reported line 130)May include surrounding context.
md
Stop a `SCHEDULED` or `RESCHEDULED` post from publishing. The post stays, with status `CANCELLED`. Returns the post. ### `DELETE /posts/{id}` Permanently delete a post. Cannot be undone. Returns `{ "id": "..." }`.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 88% confidence
Finding: The DELETE /media/{id} endpoint deletes uploaded media, and if an agent accepts or derives media IDs from untrusted context, a user could unintentionally or maliciously remove assets needed for future campaigns. In a content-management skill, destructive media operations are especially sensitive because asset libraries are shared workflow resources and deletion may disrupt scheduled or draft work.
Content: Scanner excerpt · references/api-reference.md (reported line 161)May include surrounding context.
md
| `type` | `image` or `video` (library items) | | `page`, `pageSize` | Library paging, default 50, max 100 | ### `DELETE /media/{id}` Delete an uploaded file. Returns `204`. Posts already published are not affected.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 90% confidence
Finding: The skill is explicitly designed to send authenticated HTTPS requests to an external third-party API using a bearer token from the environment. This is an intentional data egress path and exposes the agent to transmitting account data, media, analytics, comments, and posting actions outside the local trust boundary.
Content: Scanner excerpt · SKILL.md (reported line 11)May include surrounding context.
md
env: - POSTPLANIFY_API_KEY bins: - curl primaryEnv: POSTPLANIFY_API_KEY envVars: - name: POSTPLANIFY_API_KEY

External Transmission

Medium

Category: Data Exfiltration
Confidence: 94% confidence
Finding: The example call sends the POSTPLANIFY_API_KEY as a bearer token to an external service to validate credentials. Even though this is expected behavior for the integration, it is still a true external transmission risk because compromised instructions or misuse could cause authenticated access to third-party data.
Content: Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.
Check the key works:

bash
curl -s https://api.postplanify.com/api/v1/me \ -H "Authorization: Bearer $POSTPLANIFY_API_KEY"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 92% confidence
Finding: The skill's basic design mandates attaching the bearer token on every request to a remote API. In context, this is not stealth exfiltration, but it is still a security-relevant capability because the agent can access and transmit potentially sensitive business and social-media content to an external platform.
Content: Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.
md
## Basics - **Base URL:** `https://api.postplanify.com/api/v1` - **Auth header:** `Authorization: Bearer $POSTPLANIFY_API_KEY` on every request - **Success:** `{ "ok": true, "data": ... }`, plus `pagination` on list endpoints - **Error:** `{ "ok": false, "error": { "code": "...", "message": "..." } }`. Show the `message` to the user; it says exactly what is wrong.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 93% confidence
Finding: Listing workspaces and social accounts retrieves organizational metadata from a third-party service using the API key. This is a genuine authenticated external access path and could expose account structure or enable follow-on actions if invoked without clear user authorization.
Content: Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.
1. Find the workspace and account

bash
curl -s https://api.postplanify.com/api/v1/workspaces \ -H "Authorization: Bearer $POSTPLANIFY_API_KEY"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 95% confidence
Finding: The media-from-URL workflow causes the external service to fetch user-supplied content from arbitrary URLs, which expands the data flow and trust boundary beyond just the PostPlanify API. This can unintentionally transmit sensitive URLs or ingest malicious/unexpected remote content into the user's publishing workflow.
Content: Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.
From a public URL (preferred, no local file needed):

bash
curl -s -X POST https://api.postplanify.com/api/v1/media/from-url \ -H "Authorization: Bearer $POSTPLANIFY_API_KEY" \ -H "Content-Type: application/json" \ -d '{"url": "https://example.com/photo.jpg"}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 95% confidence
Finding: The local-file upload flow transmits local media files from the agent environment to an external API. In context this is core functionality, but it is security-sensitive because it can exfiltrate local files if path handling is abused or if the agent is tricked into uploading unintended content.
Content: Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.
From a local file:

bash
curl -s -X POST https://api.postplanify.com/api/v1/media/upload \ -H "Authorization: Bearer $POSTPLANIFY_API_KEY" \ -F "file=@/path/to/video.mp4"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 94% confidence
Finding: Creating posts sends user-generated content, scheduling data, and linked media identifiers to an external service for publication. This is expected for the skill, but it is still a true security-sensitive transmission because it can create public-facing content and expose internal campaign details.
Content: Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.
3. Create the post

bash
curl -s -X POST https://api.postplanify.com/api/v1/posts \ -H "Authorization: Bearer $POSTPLANIFY_API_KEY" \ -H "Content-Type: application/json" \ -d '{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 91% confidence
Finding: Fetching post status and logs retrieves potentially sensitive publication metadata and error details from the external API. While lower risk than write operations, it still represents authenticated data access outside the local environment.
Content: Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.
4. Check the result

bash
curl -s https://api.postplanify.com/api/v1/posts/POST_ID \ -H "Authorization: Bearer $POSTPLANIFY_API_KEY"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/api-reference.md (reported line 3)May include surrounding context.
md
# PostPlanify API reference Base URL: `https://api.postplanify.com/api/v1` Auth: `Authorization: Bearer $POSTPLANIFY_API_KEY` on every request. All timestamps are UTC, ISO 8601. The machine-readable spec is at https://postplanify.com/openapi.yaml.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/api-reference.md (reported line 148)May include surrounding context.
md
# PostPlanify API reference Base URL: `https://api.postplanify.com/api/v1` Auth: `Authorization: Bearer $POSTPLANIFY_API_KEY` on every request. All timestamps are UTC, ISO 8601. The machine-readable spec is at https://postplanify.com/openapi.yaml.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The API reference documents irreversible deletion operations for posts and media, but it does not include any guidance that agents should require explicit user confirmation before invoking them. In an agent skill that can autonomously translate natural-language requests into API actions, this increases the risk of accidental or prompt-induced destructive actions that cannot be undone.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

SkillSpector

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

External Transmission

External Transmission

External Transmission

External Transmission

1. Find the workspace and account

External Transmission

External Transmission

External Transmission

3. Create the post

External Transmission

4. Check the result

External Transmission

External Transmission

Missing User Warnings

Static analysis