Facebook-poster

• Outcome: Review
• Latest audit: Sep 12, 2026 · 7:57 AM UTC
• Version: 1.0.0

Overview

This skill is coherent as a Qvicker.lt marketing-post helper, but it directs agents to publish to Facebook without an approval gate and to invent realistic customer-style testimonials.

Install only if you are comfortable with a skill that may post branded Qvicker.lt content to Facebook. Configure the agent to draft first and require explicit approval before publishing, and do not use the testimonial theme unless the claims are verified or clearly labeled as fictional examples.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:26
• Finding: Mandatory Injection of Branded Promotional Content## Vulnerability Details **File Location**: `SKILL.md`, line 26 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: Medium **Complete Code Snippet**: ```markdown - Pabaigoje pridėk aiškų kvietimą veikti (CTA): „Raskite patikimą meistrą savo mieste šiandien: www.qvicker.lt“. ``` English translation: “At the end, add a clear call to action: ‘Find a reliable specialist in your city today: www.qvicker.lt’.” ### Technical Analysis The Skill requires every generated post to contain a predetermined promotional call to action and external URL. Rather than allowing the user or calling agent to decide whether branded advertising is appropriate, this instruction persistently controls part of the final output whenever the Skill is used. This represents instruction-level output manipulation. Although the promotion is related to the Skill's declared purpose, it is mandatory and lacks a requirement to obtain the user's informed approval before injecting the advertising link. No code execution, credential theft, or system-level safety-constraint bypass was identified. ### Attack Path 1. The Skill is loaded into an agent session. 2. A user requests generation of a daily Facebook post. 3. The Skill requires the agent to append the prescribed Qvicker.lt promotional call to action. 4. The promotional URL is included even if the user did not explicitly request that specific link or wording. 5. If combined with the publication instruction on line 27, the mandatory promotion may be published externally. ### Impact Assessment The issue affects output integrity and user control. It can cause branded advertising and an external URL to be inserted into generated content without separate consent. It does not grant operating-system privileges, expose credentials, or independently enable code execution. Its scope is limited to content generated while this Skill is active and any external channels to which that content i ...[truncated 25 chars]
• Remediation: ## Remediation Suggestions - Treat generated posts as drafts unless the user explicitly requests promotional branding. - Ask whether the Qvicker.lt URL and prescribed call to action should be included. - Permit users to edit or remove branding before publication. - Clearly disclose in the Skill description that generated content is promotional. - Avoid fixed output requirements that override explicit user instructions concerning links, branding, or calls to action.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:27
• Finding: External Facebook Publication Without an Explicit Confirmation Gate## Vulnerability Details **File Location**: `SKILL.md`, line 27 **Vulnerability Type**: `T05: Unauthorized Access and Privilege Escalation` **Risk Level**: High **Complete Code Snippet**: ```markdown 4. **Veiksmas:** Naudok savo naršymo įrankį, kad peržiūrėtum Qvicker.lt (jei reikia), ir naudok `facebook.post_update` įrankį įrašo paskelbimui. ``` English translation: “Action: Use your browsing tool to review Qvicker.lt if needed, and use the `facebook.post_update` tool to publish the post.” ### Technical Analysis The Skill directs the agent to invoke an authenticated Facebook publication tool after generating content. It does not require a preview, validation of the destination account or page, or explicit user confirmation immediately before the external side effect. If the agent has access to a connected Facebook account, a content-generation request could therefore be interpreted as authorization to publish. This conflates drafting with execution and violates least-privilege principles for consequential tool use. The instruction does not itself acquire new credentials or bypass Facebook authorization; it exercises whatever posting privileges are already available to the agent. ### Attack Path 1. A Facebook account or page is connected to the agent through `facebook.post_update`. 2. The Skill is loaded and the user asks it to generate the day's post. 3. The agent creates content according to the Skill instructions. 4. Without presenting the final draft and requesting confirmation, the agent invokes `facebook.post_update`. 5. The post becomes publicly visible under the connected account or page. 6. Repeated or automated invocation could result in multiple unauthorized public posts. ### Impact Assessment Exploitation can use the Facebook posting privileges already delegated to the agent. The affected scope includes public content, brand reputation, account activity, and potentially all audiences reachable through ...[truncated 329 chars]
• Remediation: ## Remediation Suggestions - Generate a draft by default and never publish as an implicit consequence of a generation request. - Display the complete final post, destination account or page, visibility, and publication time before execution. - Require an explicit, single-use confirmation immediately before calling `facebook.post_update`. - Separate “generate,” “approve,” and “publish” into distinct workflow stages. - Apply least-privilege OAuth scopes and restrict posting access to the intended page. - Record an audit log containing the approving user, final content, destination, and publication result. - Add duplicate-post prevention, rate limits, and an emergency disable control.

other

Warning

• Location: SKILL.md:22
• Finding: Generation of Fabricated Customer Testimonials as Social Proof## Vulnerability Details **File Location**: `SKILL.md`, line 22 **Vulnerability Type**: `other: Deceptive Content Generation` **Risk Level**: Medium **Complete Code Snippet**: ```markdown - **Socialinis įrodymas:** Sugalvok trumpą, tikrovišką istoriją ar atsiliepimą, panašų į realių klientų (pvz., kaip kažkas greitai rado pagalbą Vilniuje ar Kaune). ``` English translation: “Social proof: Invent a short, realistic story or testimonial resembling those of real customers, for example how someone quickly found help in Vilnius or Kaunas.” ### Technical Analysis The instruction explicitly tells the agent to invent realistic stories or testimonials that resemble genuine customer experiences. When included in promotional material without a clear fictional label, such content can be mistaken for verified social proof. The risk becomes more significant because the same Skill directs the agent to publish generated material to Facebook. A fabricated testimonial may therefore move directly from generation to public advertising without fact-checking or disclosure. ### Attack Path 1. The Skill selects or is prompted to use the social-proof content theme. 2. The agent invents a plausible customer story or review involving Qvicker.lt. 3. The generated post presents the story in a realistic promotional format without identifying it as fictional. 4. The publication instruction causes or encourages the content to be posted to Facebook. 5. Readers may interpret the fabricated account as a genuine customer experience and rely on it when making purchasing decisions. ### Impact Assessment The issue can mislead consumers, damage the organization’s reputation, and create advertising, consumer-protection, or platform-policy compliance exposure. Its scope covers generated marketing content and any audience reached through publication. It does not provide technical access to accounts, files, credentials, or system privileges.
• Remediation: ## Remediation Suggestions - Remove instructions to invent realistic customer testimonials. - Use only verified testimonials supported by source records and appropriate customer consent. - Preserve attribution and avoid changing claims in ways that alter their meaning. - If fictional scenarios are used for illustration, label them prominently as hypothetical examples. - Require human review and claim verification before promotional content is published. - Maintain provenance records for testimonials, including consent, source, approval status, and permitted uses.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The metadata fixes the skill language to Lithuanian, and the prompt reinforces that every post should be created in Lithuanian. This is a language policy constraint presented as mandatory, with no option for the user to choose another language or explicitly opt in.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The instruction says to create a Facebook post "lietuvių kalba" each day, which forces a specific language in the skill behavior. The file does not provide any user-choice mechanism or documented justification that would exempt this requirement.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly instructs the agent to use `facebook.post_update` to publish content, but it does not require explicit user confirmation, preview, or a final approval step before taking an external side effect. That creates a real risk of unauthorized or mistaken posting to a public social media account, which can cause reputational harm and unintended disclosure.

Static analysis

No suspicious patterns detected.