Security audit
Security checks for vulnerabilities and agentic risk
This skill is mostly coherent for managing Kleos social posts, but it grants broad account/tool authority through an unpinned CLI and generic tool-call interface.
Review before installing. Prefer a pinned, reviewed Kleos CLI version or a preinstalled binary, use least-privilege API keys, avoid running this unattended in CI/cron with broad account scopes, and require explicit user approval for publishing, scheduling, spending, account connections, team changes, or generic `kleos call` operations.
The manifest references the CLI in a way that operationally encourages unpinned execution of the MCP client, which is a supply-chain risk when agents autonomously install and run tools. In this context, the tool has broad networked capabilities and access to authentication material, increasing the blast radius of a malicious release.
The skill instructs agents to execute npx -y kleos-cli, which fetches and runs the latest package version at runtime without pinning an exact version or integrity digest. This creates a supply-chain execution risk: a compromised package release, account takeover, or malicious dependency update could immediately result in arbitrary code execution in every environment using the skill.
The description lists activation phrases such as "generate posts for my app", "plan the week of posts", and "how are my posts doing", which are broad natural-language requests that could match ordinary conversation rather than an intentionally invoked skill. The file does not provide exclusion conditions or negative examples to clarify when the skill should not activate.
The documentation again directs use of npx -y kleos-cli without a fixed version, causing runtime retrieval and execution of unreviewed code from the package registry. Because this skill also handles API keys, browser login tokens, uploads, and account actions, compromise of the fetched package could expose credentials and perform unauthorized actions.
The skill advertises a relatively focused purpose, but then exposes a generic kleos call <tool> interface to invoke any MCP tool by name, including functionality outside the declared scope. This is dangerous because agents may be socially engineered into performing sensitive or higher-impact operations that users did not reasonably expect from a social-posting skill.
Including invite_member extends the skill into team-management and account-administration territory, which is unrelated to ordinary content creation and scheduling. If an agent can trigger this capability, an attacker could manipulate the agent into adding unauthorized collaborators or escalating access within the platform.
The manifest-style description includes both English and Portuguese trigger phrases, but does not state how the skill determines which language to use or offer an explicit language/locale preference to the user. This can violate language-choice policy when a skill implicitly imposes or switches language without opt-in.
No suspicious patterns detected.
