Postiz is a tool to schedule social media and chat posts to 28+ channels X, LinkedIn, LinkedIn Page, Reddit, Instagram, Facebook Page, Threads, YouTube, Google My Business, TikTok, Pinterest, Dribbble, Discord, Slack, Kick, Twitch, Mastodon, Bluesky, Lemmy, Farcaster, Telegram, Nostr, VK, Medium, Dev.to, Hashnode, WordPress, ListMonk

• Outcome: Review
• Latest audit: Jul 10, 2026 · 2:22 AM UTC
• Version: 1.0.15

Overview

This appears to be a legitimate Postiz automation skill, but it gives an agent broad power to post, upload media, and delete social content with weak confirmation and credential-safety guidance.

Install only if you want an agent to operate Postiz on real connected social accounts. Require the agent to show the exact content, media files, target platform/account, integration IDs, schedule, and any deletion target before running create, upload, connect, or delete commands. Prefer drafts or test accounts first, avoid storing API keys in shell profiles, do not print secrets in terminals, and remove OAuth credentials with `postiz auth:logout` when persistent access is not needed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (16)

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: This documentation instructs an agent to perform live and scheduled posting across many external platforms, including multi-platform campaigns and immediate posting, without any explicit warning that these actions affect real third-party accounts and public-facing data. In an agent skill context, that omission increases the chance of unintended publication, spam, reputational harm, or posting to the wrong integrations because the examples normalize direct execution rather than requiring confirmation or safe/draft defaults.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The guide recommends appending the API key to shell startup files, which stores the secret in plaintext on disk and can expose it through backups, dotfile syncing, shoulder surfing, or later accidental disclosure. While common in developer docs, it weakens credential hygiene because it normalizes long-lived secret persistence without any warning or safer alternative.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documentation tells users to run `echo $POSTIZ_API_KEY` to verify the variable, which prints the full secret to the terminal and may expose it in screen recordings, shared terminals, shell logs, or observability tooling. This is a real but lower-severity secret-handling issue because it increases accidental disclosure risk rather than directly compromising the system.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The later environment-variable section again instructs users to persist the API key in shell profile files and even source them immediately, reinforcing a pattern of storing secrets in plaintext without caveats. In a CLI skill context where API keys grant posting capability across many third-party channels, accidental disclosure could enable unauthorized posting or account misuse.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This workflow encourages an AI agent to automatically enumerate available tools and invoke them, then proceed toward post creation on connected third-party accounts, but it does not clearly warn that these commands can cause real external side effects. In an agent context, omission of an explicit confirmation or dry-run boundary increases the risk of unintended live actions, especially when accounts are already authenticated.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The complete example script uses a real API key variable and integration ID, retrieves data from a live integration, and then calls `postiz posts:create`, which will publish content to an external platform if valid credentials are present. For an automation or AI-agent skill, this is dangerous because users may copy or run the script without realizing it performs irreversible actions on connected social accounts.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The documentation instructs users to create and publish posts to many third-party platforms, including content, media, and integration identifiers, but does not clearly warn that these commands will transmit user-supplied data to external services. In an agent or automation context, this omission can cause unintentional disclosure or posting of sensitive or private material because users may treat the CLI action as a local formatting step rather than an outbound publish operation.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation provides copy-pasteable commands that create posts on real external platforms, but it does not clearly warn users that these examples can publish live content to linked accounts. In a tool that automates posting to 28+ social and chat services, this omission increases the risk of accidental public posting, reputational harm, spam, or unintended actions against production accounts.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The quick-start documents a destructive `postiz posts:delete` command without any warning, confirmation guidance, or note that deletion may be irreversible. In an agent or copy-paste workflow, this increases the chance of accidental post deletion and operational mistakes, especially when users act on examples verbatim.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The guide tells users to persist `POSTIZ_API_KEY` in a shell profile as plaintext but does not warn that shell startup files are long-lived local storage for secrets and may be exposed through backups, shared accounts, screenshots, or accidental commits. This is not remote code execution, but it is a real credential-handling weakness that can lead to API key disclosure.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill documents `postiz posts:delete <post-id>` as a routine management command without an adjacent warning that it is destructive and may permanently remove scheduled or published content. In an agentic context, this increases the chance an assistant invokes deletion during troubleshooting or cleanup without explicit user confirmation, causing unintended content loss.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The summary promotes commands that create, delete, and upload content to remote social media accounts without clearly warning that these actions change external state and may affect user data. In an AI-agent context, that omission increases the chance an agent or operator will run destructive or privacy-impacting commands without adequate confirmation, review, or sandboxing.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The documentation shows users how to upload files and reuse returned CDN URLs without clearly warning that the content is sent to a remote Postiz service and may become externally accessible. In a CLI for social publishing, users may mistakenly upload sensitive local files or assume the operation is purely local, creating a real risk of unintended data disclosure.

Missing User Warnings

Low

• Confidence: 87% confidence
• Finding: The example instructs users to export an API key but does not state that the key is sensitive or advise safe handling. This can lead to accidental disclosure through shell history, screenshots, shared terminals, or checked-in environment files, enabling unauthorized use of the user's Postiz account.

Session Persistence

Medium

• Category: Rogue Agent

Content

2. **Discover** - List integrations and get their settings
3. **Fetch** - Use integration tools to retrieve dynamic data (flairs, playlists, companies)
4. **Prepare** - Upload media files if needed
5. **Post** - Create posts with content, media, and platform-specific settings
6. **Analyze** - Track performance with platform and post-level analytics
7. **Resolve** - If analytics returns `{"missing": true}`, run `posts:missing` to list provider content, then `posts:connect` to link it

• Confidence: 70% confidence
• Finding: Create posts with content, media, and platform-specific settings 6. **Analyze** - Track performance with platform and post-level analytics 7. **Resolve** - If analytics returns `{"missing": true}`, ru

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

1. **Endpoints Used**
   - `POST /public/v1/posts` - Create post
   - `GET /public/v1/posts` - List posts
   - `DELETE /public/v1/posts/:id` - Delete post
   - `GET /public/v1/integrations` - List integrations
   - `POST /public/v1/upload` - Upload media

• Confidence: 78% confidence
• Finding: DELETE /public/v1/posts/:id`

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.