T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:47- Finding
Mutable Remote Installation Script Is Piped Directly into Bash
- Content
View full analysis
- Remediation
View remediation
Security audit
Postavel
Security checks for vulnerabilities and agentic risk
Overview
The skill is coherent for Postavel social media management, but its setup instructions include unsafe remote and privileged installer patterns before connecting an account that can publish or delete posts.
Review this skill before installing. Prefer the manual setup path, avoid the curl-to-bash installer, avoid any sudo/global binary installation unless you have independently verified the source, and confirm the exact Postavel workspace, brand, post, and publishing action before approving, auto-approving, publishing, or deleting content.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T08 · Insecure Dependencies
Error
- Location
scripts/install-mcp.sh:84- Finding
Unverified Mutable Release Binary Is Installed into a Privileged Global Path
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Error
- Location
scripts/install-mcp.sh:60- Finding
Unpinned Package-Manager Dependencies Are Installed Globally
- Content
View full analysis
/dev/null; then print_info "Installing via Homebrew..." brew install mcporter MCPORter_PATH=$(which mcporter) else # Fall back to npm print_info "Installing via npm..." npm install -g mcporter ``` Equivalent unpinned installation commands also appear in: - `SKILL.md:29-36` - `scripts/setup-mcp.sh:7-17` - `references/setup-guide.md:25-33` ### Technical Analysis The Skill installs `mcporter` without specifying an audited version or validating the installed artifact. The npm path uses global installation, which can execute package lifecycle scripts during installation and modifies a global package location. The Homebrew command similarly resolves whatever formula version and dependency graph are current at installation time. No evidence in the audited project proves that `mcporter` is malicious. The vulnerability is that the Skill delegates executable-code selection to mutable third-party package infrastructure without version or integrity constraints. A compromised package, registry account, formula, dependency, or package-manager source can therefore introduce code that was not present during the audit. Global installation is broader than necessary for connecting one user account to an MCP service. Depending on local npm configuration, `npm install -g` may fail, request elevated privileges, or modify shared executable locations. ### Attack Path 1. A user runs the documented setup or either included installer while `mcporter` is absent. 2. The installer requests the current `mcporter` package from Homebrew or npm without a pinned version. 3. An attacker compromises the package publisher, registry account, formula repository, transitive dependency, or release pipeline. 4. The package mana ...[truncated 1060 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (22)
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The skill instructs the user to execute a remote install script directly from the network via
curl -fsSL https://postavel.com/install-mcp | bash. Piping fetched content into a shell prevents meaningful review and enables full arbitrary code execution if the remote server, TLS path, or script content is compromised.- Content
Alternative: Install Script
bash curl -fsSL https://postavel.com/install-mcp | bashTroubleshooting
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 97% confidence
- Finding
The
| bashchaining pattern turns downloaded remote content into immediate shell execution, which is a classic command-chaining abuse vector. In this skill, the risk is elevated because the setup flow is presented as a normal first-run step, making unsafe execution more likely to be followed without scrutiny.- Content
Alternative: Install Script
bash curl -fsSL https://postavel.com/install-mcp | bashTroubleshooting
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The script explicitly instructs users to execute code streamed directly from a remote server with curl | bash, which removes any opportunity for inspection and makes compromise of the hosting endpoint immediately equivalent to arbitrary code execution. In an installer for an AI-connected social media integration, this is especially risky because it leads to local execution before the user can assess what account access or configuration changes will occur.
- Content
sh #!/bin/bash # Postavel MCP Installer # One-command setup for mcporter # Run: curl -fsSL https://postavel.com/install-mcp | bash set -e
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 97% confidence
- Finding
Using a shell pipe into bash creates a dangerous execution chain where remote content is immediately interpreted as commands, amplifying any compromise, redirect, or content injection into instant code execution. This pattern is broadly unsafe and particularly problematic for setup flows that also install binaries, write persistent config, and launch authentication steps.
- Content
sh #!/bin/bash # Postavel MCP Installer # One-command setup for mcporter # Run: curl -fsSL https://postavel.com/install-mcp | bash set -e
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill instructs users to run shell commands (
brew,npm,mcporter,find, and a remote install script) but does not declare any tool scope such aspermissionsorallowed-tools. This creates a mismatch between documented capabilities and declared boundaries, increasing the risk that an agent may attempt unsafe shell execution without explicit authorization controls.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The activation text includes broad triggers like 'social media', 'create post', and posting to major platforms, which can cause the skill to activate in contexts beyond Postavel-specific intent. Over-broad invocation increases the chance that users are routed into setup flows containing shell commands or approval/publishing actions when they did not specifically request this integration.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
With Auto-Approval (Admin/Owner only):
text "Schedule a post for [time] and auto-approve it" "Create and publish a post now"
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
With Auto-Approval (Admin/Owner only):
text "Schedule a post for [time] and auto-approve it" "Create and publish a post now"
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
With Auto-Approval (Admin/Owner only):
text "Schedule a post for [time] and auto-approve it" "Create and publish a post now"
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md The AI assistant respects Postavel's permission system: | Role | Can Create | Can Approve | Can Auto-Approve | |------|-----------|-------------|------------------| | **Owner** | ✅ | ✅ | ✅ | | **Admin** | ✅ | ✅ | ✅ |
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
The create_post interface exposes an auto_approve option that enables immediate approval, reducing human review for publishing actions. In a social media management skill, this can let an agent take higher-impact actions than a user may expect from a simple 'create post' request, especially if the agent infers approval rather than obtaining explicit authorization.
- Content
md - `status` (optional): 'draft', 'scheduled', or 'published' (default: 'draft') - `scheduled_at` (optional): ISO 8601 datetime (required if status='scheduled') - `media_urls` (optional): Array of external image/video URLs - `auto_approve` (optional): boolean - Immediately approve (admin/owner only) **Use when:** User wants to create a social media post
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 86% confidence
- Finding
The reference explicitly notes that posts may bypass the normal approval workflow when auto_approve=true, which weakens separation between content creation and approval. In this skill's context, bypassing review is materially risky because posts may be published or advanced toward publication on external brand accounts, creating reputational and operational harm.
- Content
md **Important:** - One post can target multiple platforms - Posts require approval before publishing (unless auto_approve=true and user has permissions) ---
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The tool reference documents deletion of posts but provides no guidance to require explicit user confirmation, preview the target post, or warn that deletion is irreversible. In an agentic context, this increases the risk that a natural-language misunderstanding or ambiguous reference could cause unintended content loss across a user's social media workflow.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md - User is not an admin of any LinkedIn company pages - They need to be added as admin on LinkedIn **"Auto-approve not allowed"** - User is a Member (not Admin/Owner) - Post is created but remains pending
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md - User is not an admin of any LinkedIn company pages - They need to be added as admin on LinkedIn **"Auto-approve not allowed"** - User is a Member (not Admin/Owner) - Post is created but remains pending
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md This script will: 1. Check if `mcporter` is installed 2. Install it via Homebrew if missing 3. Create mcporter configuration for Postavel 4. Guide you through OAuth authentication ## Manual Setup
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 92% confidence
- Finding
The script downloads an executable from the network and writes it into /usr/local/bin using sudo, which elevates a network-fetched artifact to a system-wide trusted binary. If the download source, transport, release channel, or GitHub account is compromised, this becomes privileged arbitrary code installation.
- Content
sh fi print_info "Downloading from: $URL" sudo curl -L -o /usr/local/bin/mcporter "$URL" sudo chmod +x /usr/local/bin/mcporter MCPORter_PATH="/usr/local/bin/mcporter" fi
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 89% confidence
- Finding
Running chmod with sudo on the downloaded binary is part of making a root-installed executable immediately runnable system-wide. On its own this is less severe than the download, but in context it completes privileged persistence of an unverified external binary.
- Content
sh print_info "Downloading from: $URL" sudo curl -L -o /usr/local/bin/mcporter "$URL" sudo chmod +x /usr/local/bin/mcporter MCPORter_PATH="/usr/local/bin/mcporter" fi
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
sh print_status "mcporter installed at: $MCPORter_PATH" fi # Step 3: Create config directory print_info "Creating configuration..." mkdir -p "$HOME/.config/mcporter"
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 78% confidence
- Finding
The script creates a persistent configuration file under ~/.config/mcporter/postavel.json, which survives beyond the current session and can influence later agent/tool behavior. Persistent tool configuration can expand attack surface if later compromised, misused by another local process, or left behind without the user's clear understanding, especially because it wires in a remote MCP endpoint and OAuth flow.
- Content
sh fi fi # Create mcporter config directory mkdir -p ~/.config/mcporter # Generate config for Postavel
Excessive Permissions
Low
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.
- Content
md - "Approve post ID 123" - "Approve all pending posts for brand 'Coffee Shop'" **Permissions:** Only workspace Admins and Owners can approve posts ---
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The example invocation is written as a fixed English phrase, 'Then you can say: 'Schedule a Facebook post for tomorrow'' without indicating that other languages are supported. Under the stated policy, natural-language instructions that force a specific language without user choice can be considered a locale/language policy violation.
- Content
Static analysis
No suspicious patterns detected.