Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed social-media drafting and publishing helper that uses platform credentials only for the expected posting workflows.
Before installing, make sure you are comfortable giving the agent access to social-media credentials via environment variables. Use --dry-run first, review the exact platform, account or subreddit, text, and image path, and only allow live publishing after explicit approval.
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
'access_token': token,
}
r = requests.post(url, data=data, files=files, timeout=30)
try:
payload = r.json()
except Exception:
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
if missing:
raise RuntimeError('Missing Reddit credentials: ' + ', '.join(missing))
r = requests.post(
TOKEN_URL,
auth=HTTPBasicAuth(client_id, client_secret),
data={'grant_type': 'password', 'username': username, 'password': password},
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
if kind == 'image':
mime = mimetypes.guess_type(args.image_file)[0] or 'image/jpeg'
filename = os.path.basename(args.image_file)
asset_req = requests.post(
f'{API_BASE}/api/media/asset.json',
headers=headers,
data={'filepath': filename, 'mimetype': mime},
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
'api_type': 'json',
'text': args.text or '',
}
submit_resp = requests.post(f'{API_BASE}/api/submit', headers=headers, data=submit_data, timeout=60)
submit_resp.raise_for_status()
submit_json = submit_resp.json()
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
'richtext_json': json.dumps(rtjson),
'validate_on_submit': 'true',
}
r = requests.post(f'{API_BASE}/api/editusertext', headers=headers, data=edit_data, timeout=60)
else:
data = {
'sr': subreddit,
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
data['text'] = args.text or ''
else:
data['url'] = args.url
r = requests.post(f'{API_BASE}/api/submit', headers=headers, data=data, timeout=30)
try:
payload = r.json()
except Exception:
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
media_ids = []
if args.image_file:
with open(args.image_file, 'rb') as f:
upload = requests.post(f'{UPLOAD_BASE}/media/upload.json', auth=auth, files={'media': f}, timeout=60)
upload_data = upload.json()
if upload.status_code >= 400 or 'media_id_string' not in upload_data:
print(json.dumps(upload_data, indent=2))
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
payload = {'text': args.text}
if media_ids:
payload['media'] = {'media_ids': media_ids}
r = requests.post(f'{API_BASE}/tweets', auth=auth, json=payload, timeout=30)
try:
data = r.json()
except Exception:
Claiming Facebook, X, and Reddit support with safer wording and approval-first behavior, while actual behavior may only support direct X posting, creates a false security model around high-risk account actions. That mismatch can lead users to entrust sensitive content and credentials to a tool that lacks the documented guardrails and validation steps.
Claiming Facebook, X, and Reddit support with safer wording and approval-first behavior, while actual behavior may only support direct X posting, creates a false security model around high-risk account actions. That mismatch can lead users to entrust sensitive content and credentials to a tool that lacks the documented guardrails and validation steps.
Claiming Facebook, X, and Reddit support with safer wording and approval-first behavior, while actual behavior may only support direct X posting, creates a false security model around high-risk account actions. That mismatch can lead users to entrust sensitive content and credentials to a tool that lacks the documented guardrails and validation steps.
Claiming Facebook, X, and Reddit support with safer wording and approval-first behavior, while actual behavior may only support direct X posting, creates a false security model around high-risk account actions. That mismatch can lead users to entrust sensitive content and credentials to a tool that lacks the documented guardrails and validation steps.
File contents flow to a network sink. This may indicate data exfiltration of sensitive files.
'access_token': token,
}
r = requests.post(url, data=data, files=files, timeout=30)
try:
payload = r.json()
except Exception:
The skill documents access to environment-configured credentials, local file handling, and network-backed publishing flows, but it does not declare any explicit tool scope or permissions boundary. That creates a governance gap where an agent may be allowed to invoke sensitive capabilities without a clear least-privilege contract, increasing the chance of unintended credential use, file manipulation, or outbound posting.
The skill describes use of environment-backed social-media credentials and outbound posting to third-party platforms without clearly warning about privacy, account compromise, or accidental disclosure risks. In a publishing skill, weak disclosure increases the likelihood that users will unknowingly authorize actions affecting public accounts or sensitive brand communications.
This script performs live Reddit publishing as soon as it is invoked unless --dry-run is manually supplied, with no built-in confirmation gate or explicit approval check. In an agent skill whose advertised behavior includes approval-first workflow, this increases the risk of unintended public posting, reputational harm, or accidental disclosure if an upstream agent/user step misfires.
The upload destination URL is taken from a prior network response and then used directly in a second POST without validating the hostname or scheme. If the upstream response were malformed, compromised, or intercepted in some other trust failure, the script could be induced to upload a local file to an unintended endpoint, turning this into an SSRF/exfiltration-style primitive.
upload_url = 'https:' + upload_args['action'] if upload_args['action'].startswith('//') else upload_args['action']
upload_fields = {item['name']: item['value'] for item in upload_args['fields']}
with open(args.image_file, 'rb') as f:
upload_resp = requests.post(upload_url, data=upload_fields, files={'file': f}, timeout=60)
upload_resp.raise_for_status()
# Step 1: create a self post
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
'richtext_json': json.dumps(rtjson),
'validate_on_submit': 'true',
}
r = requests.post(f'{API_BASE}/api/editusertext', headers=headers, data=edit_data, timeout=60)
else:
data = {
'sr': subreddit,
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
import requests
from requests_oauthlib import OAuth1
API_BASE = 'https://api.twitter.com/2'
UPLOAD_BASE = 'https://upload.twitter.com/1.1'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
payload = {'text': args.text}
if media_ids:
payload['media'] = {'media_ids': media_ids}
r = requests.post(f'{API_BASE}/tweets', auth=auth, json=payload, timeout=30)
try:
data = r.json()
except Exception:
The manifest description lists a long, open-ended set of situations such as turning 'an idea' or 'long-form text' into polished posts, but it does not define clear boundaries or exclusion cases. In a manifest file, this kind of broad invocation language can overlap with ordinary drafting or rewriting requests and risks unintended activation.
The manifest description says approval-first workflow and live posting support are across Facebook, X, and Reddit. However, the workflow and output templates repeatedly include LinkedIn as a target platform for drafts, creating a mismatch between the declared platform scope and the documented behavior the skill is meant to perform.
No suspicious patterns detected.