Security audit

Postnify

Security checks for vulnerabilities and agentic risk

Overview

This skill fits a social-media scheduling tool, but it needs review because it can post or delete public content and has under-scoped install and API configuration risks.

Use this only if you trust Postnify and the npm package source. Pin or verify the CLI version before installing, do not set POSTNIFY_API_URL unless you fully trust the endpoint, and require explicit confirmation before creating, scheduling, uploading media for, or deleting posts.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:661
Finding: Agent instruction steering promotes an unrelated external Skill
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:8
Finding: Unpinned global installation of a third-party npm package
Content: View full analysis
Remediation: View remediation
`. - Record and verify the package integrity digest before installation. - Prefer a project-local dependency with a lockfile over a global installation. - Execute the CLI through a constrained project runner or isolated container. - Disable package lifecycle scripts where compatible, or explicitly audit every required lifecycle script. - Document the expected npm publisher and repository and require verification before upgrades. - Treat each version update as a new security-review event rather than automatically consuming the latest release. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:103
Finding: Configurable API origin may redirect authenticated requests to an untrusted server
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Rogue AgentSelf-Modification, Session Persistence
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.
md
--- name: postnify-agent description: Postnify is a tool to schedule social media and chat posts to 28+ channels X, LinkedIn, LinkedIn Page, Reddit, Instagram, Facebook Page, Threads, YouTube, Google My Business, TikTok, Pinterest, Dribbble, Discord, Slack, Kick, Twitch, Mastodon, Bluesky, Lemmy, Farcaster, Telegram, Nostr, VK, Medium, Dev.to, Hashnode, WordPress, ListMonk metadata: {"openclaw":{"emoji":"🌎","requires":{"bins":["postnify"],"env":["POSTNIFY_API_KEY","POSTNIFY_API_URL"],"auth":["oauth2-device-flow","api-key"],"storage":["~/.postnify/credentials.json"],"network":["https://platform.postnify.com/api","https://cli-auth.postnify.com"]}}} --- ## Install Postnify if it doesn't exist

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.
md
--- name: postnify-agent description: Postnify is a tool to schedule social media and chat posts to 28+ channels X, LinkedIn, LinkedIn Page, Reddit, Instagram, Facebook Page, Threads, YouTube, Google My Business, TikTok, Pinterest, Dribbble, Discord, Slack, Kick, Twitch, Mastodon, Bluesky, Lemmy, Farcaster, Telegram, Nostr, VK, Medium, Dev.to, Hashnode, WordPress, ListMonk metadata: {"openclaw":{"emoji":"🌎","requires":{"bins":["postnify"],"env":["POSTNIFY_API_KEY","POSTNIFY_API_URL"],"auth":["oauth2-device-flow","api-key"],"storage":["~/.postnify/credentials.json"],"network":["https://platform.postnify.com/api","https://cli-auth.postnify.com"]}}} --- ## Install Postnify if it doesn't exist

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.
md
2. **Discover** - List integrations and get their settings 3. **Fetch** - Use integration tools to retrieve dynamic data (flairs, playlists, companies) 4. **Prepare** - Upload media files if needed 5. **Post** - Create posts with content, media, and platform-specific settings 6. **Analyze** - Track performance with platform and post-level analytics 7. **Resolve** - If analytics returns `{"missing": true}`, run `posts:missing` to list provider content, then `posts:connect` to link it

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill documents a destructive postnify posts:delete <post-id> command without any warning to confirm intent, preview the target, or recommend safer alternatives. In an agent setting, this increases the chance of accidental deletion of scheduled or published social-media content, especially if the agent executes documentation-driven workflows automatically.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.