Social Poster

• Analyzed: May 11, 2026, 4:51 AM
• Findings: 1
• Version: 1.0.0
• Hash: 53bb04808ae585c67cb298968f575193437da4c007a2c9f4ebd54b7fbbe405e0
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious primarily due to a critical vulnerability: a hardcoded API key (`API_KEY`) directly embedded in `scripts/post.mjs`. While the script's stated purpose is benign (posting to a social media API at `https://vibepost-jpaulgrayson.replit.app`), hardcoding sensitive credentials makes them easily discoverable and compromises security. There is no evidence of intentional malicious behavior like data exfiltration, unauthorized command execution, or prompt injection attempts against the agent.