Social Media Publish

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:14 PM UTC
• Version:
  1.0.0

Overview

This skill is a disclosed browser-publishing guide for social media accounts, with real posting risk but no hidden code or credential collection.

Install this only if you want an agent to operate logged-in social media publishing dashboards. Before any posting flow, confirm the target platform, title, body, cover image, and whether the action saves a draft or publishes publicly; prefer draft saving where available.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger phrases are broad enough to match ordinary user requests about posting or publishing, which can cause the agent to invoke browser automation unexpectedly. In this skill, that matters more than usual because the action can operate on authenticated social-media backends and initiate content publication workflows, increasing the chance of unintended drafting or posting.

VirusTotal

66/66 vendors flagged this skill as clean.