Publer

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:11 PM UTC
• Version: 1.0.1

Overview

The skill appears to be a real Publer/TikTok posting helper, but it needs Review because it can publish to social accounts and has weak safeguards around credentials, invocation scope, and live posting.

Review before installing. Use this only if you want an agent to access your Publer workspace and upload or publish TikTok content. Do not store the Publer API key in TOOLS.md or source control, prefer a least-privileged key, use --dry-run first, and require human approval before any live upload, schedule, or publish command.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:30

Finding

Documentation Recommends Plaintext Credential Storage

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:29-33
Vulnerability Type: Plaintext sensitive-data storage guidance
Risk Level: Medium

Vulnerable Snippet

markdown

**Environment Variables** (store in TOOLS.md or set before running):
- `PUBLER_API_KEY` — API key from Publer (Business plan required)
- `PUBLER_WORKSPACE_ID` — Your workspace ID
- `PUBLER_TIKTOK_ACCOUNT_ID` — TikTok account ID (optional, get via `accounts` command)

Technical Analysis

The documentation explicitly recommends storing the Publer API key and workspace identifier in TOOLS.md. A Markdown documentation file is not a secure credential store. Such files may be committed to source control, copied into backups, shared with collaborators, indexed by development tools, or exposed to agents and processes that can read project documentation.

The script uses these values to construct authenticated Publer API requests:

python

return {
    "Authorization": f"Bearer-API {key}",
    "Publer-Workspace-Id": ws,
}

Therefore, disclosure of both values may provide authenticated access to the associated Publer workspace, subject to the API key's server-side permissions.

Attack Path

1. A user follows the documented recommendation and records PUBLER_API_KEY and PUBLER_WORKSPACE_ID in TOOLS.md.
2. The file is committed, archived, shared, indexed, or read by another local tool or user.
3. An unauthorized party extracts the API key and workspace identifier.
4. The party supplies those credentials in the documented Publer HTTP headers.
5. Within the privileges granted to the key, the party can access connected-account information and potentially upload media or submit social-media posts.

Impact Assessment

The exposed credentials could grant access to the associated Publer workspace within the scope of the API key. Based on the project functionality, this may include listing connected social accounts ...[truncated 219 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the recommendation to store credentials in TOOLS.md or any other project documentation.
• Require credentials to be injected through process environment variables or a dedicated secrets manager.
• If local secret files are supported, use a clearly named file such as .env, restrict its permissions, and ensure it is excluded through .gitignore; do not treat this as a substitute for a production secrets manager.
• Document procedures for API-key rotation and immediate revocation after suspected disclosure.
• Grant the API key only the minimum Publer privileges required for the intended workflow.
• Add automated secret scanning to version-control and CI workflows.

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Unbounded Third-Party Dependency Produces Non-Reproducible Installations

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1
Vulnerability Type: Unpinned third-party dependency
Risk Level: Low

Vulnerable Snippet

text

requests>=2.31.0

The documented installation command in SKILL.md:25-27 consumes this requirement directly:

bash

pip install -r requirements.txt

Technical Analysis

The lower-bound-only constraint permits pip to install any available requests version at or above 2.31.0. As a result, installations performed at different times may resolve to different, previously unaudited releases. No package hashes are provided to verify artifact integrity.

This does not establish that the current requests package is malicious. It creates a supply-chain hardening weakness: if a future compatible release or resolved transitive dependency were compromised, the documented installation process could retrieve it without requiring a project change or integrity verification.

Attack Path

1. A future package release satisfying requests>=2.31.0, or one of its resolved dependencies, becomes compromised or otherwise unsafe.
2. A user runs the documented pip install -r requirements.txt command.
3. The package resolver selects the affected release because no exact version, lock file, or artifact hash prevents it.
4. The package is installed and subsequently imported by scripts/publer.py.
5. Any malicious code in the installed package executes with the privileges of the user running installation or the script.

This path is conditional on compromise of the package-distribution chain or a future dependency release; no such compromise was demonstrated in the audited files.

Impact Assessment

A compromised dependency could execute with the privileges of the invoking user. It could potentially read environment variables—including PUBLER_API_KEY and PUBLER_WORKSPACE_ID—access files available to that user, alter network requests, or exfi ...[truncated 151 chars]

Remediation

View remediation

Remediation Suggestions

• Pin requests and all transitive dependencies to reviewed versions through a lock file or fully pinned requirements file.
• Generate and enforce cryptographic hashes, for example by using pip-compile --generate-hashes and installing with pip --require-hashes.
• Perform dependency updates through a controlled review process rather than allowing unrestricted resolution during deployment.
• Run dependency vulnerability and provenance checks in CI.
• Install dependencies in an isolated virtual environment or container using a non-privileged account.
• Continue applying security updates promptly by regenerating and reviewing the lock file on a defined schedule.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill advertises broad multi-platform posting behavior, but the documented behavior indicates TikTok-specific post construction and an additional account-listing capability that is not clearly disclosed in the high-level description. This mismatch can mislead users and orchestrators about what the skill actually does, increasing the risk of unintended data exposure, unexpected account enumeration, or misuse under false assumptions.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill requires environment access for API keys and performs networked actions against an external publishing service, but it does not declare an explicit tool scope such as permissions or allowed-tools. That omission weakens governance and user awareness, making it easier for the skill to be invoked with broader-than-expected capabilities and to transmit sensitive content or credentials-related requests without clear policy boundaries.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description includes broad trigger phrases like 'post to TikTok', 'schedule a post', and 'publish to social media', which can cause the skill to auto-match many common user requests. Because this skill performs real external publishing actions, overbroad invocation criteria raise the chance of accidental activation and unintended posting or scheduling to connected social accounts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documentation describes commands that upload media, create posts, schedule content, and poll jobs, but it does not clearly warn that these actions send content to Publer and may publish to external social platforms. In a skill with real-world side effects, missing disclosure materially increases the risk of accidental data transmission, premature publication, reputational harm, and operational mistakes.

Content

No source excerpt is available for this finding.

Tainted flow: 'job_id' from requests.post (line 130, network input) → requests.get (network output)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/publer.py (reported line 51)May include surrounding context.

python

def poll_job(job_id, h, timeout=120):
    """Poll job until completed or failed."""
    for _ in range(timeout // 3):
        r = requests.get(f"{BASE}/job_status/{job_id}", headers=h)
        r.raise_for_status()
        data = r.json()
        status = data.get("status")

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest says the skill handles posting to TikTok, Instagram, Facebook, Twitter/X, or any Publer-supported platform. In the implementation, the only post-construction path hardcodes "networks": {"tiktok": network} and the CLI help/docstring also describe only TikTok carousel/video posting, so the actual posting capability is materially narrower than advertised.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/publer.py (reported line 127)May include surrounding context.

python

print(json.dumps(payload, indent=2))
        return

    r = requests.post(endpoint, headers=h, json=payload)
    r.raise_for_status()
    data = r.json()
    job_id = data.get("job_id")

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The dependency is specified as requests>=2.31.0, which allows any future major or minor release and makes builds non-reproducible. In a skill that publishes content to external services, dependency drift can introduce vulnerable or incompatible versions unexpectedly, increasing supply-chain risk even if no specific exploit is guaranteed today.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

requests>=2.31.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 92% confidence

Finding

The manifest references requests without pinning an exact version, so it is impossible to verify whether installation will pull a release affected by known advisories. Because this skill likely handles API tokens, media uploads, and outbound HTTP requests to third-party services, an affected requests version could increase the risk of credential leakage or unsafe request handling.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The code's post payload includes TikTok-specific concepts such as carousel title handling, auto_add_music, duet, stitch, and TikTok privacy options. This indicates the implementation is purpose-built for TikTok rather than a general Publer cross-platform posting skill as described by the manifest.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.