T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/postmoore.js:156- Finding
API Key Exposed Through Command-Line Arguments and Insecure Plaintext Storage
- Content
View full analysis
- Remediation
View remediation
Security audit
agent-Postmoore
Security checks for vulnerabilities and agentic risk
Overview
This skill does what it claims, but it can publish or delete social posts and store a live API key without enough built-in confirmation or credential safeguards.
Install only if you are comfortable giving the skill access to a Postmoore API key connected to real social accounts. Treat publish, upload, and delete actions as live external actions; ask the agent to draft first and require your explicit approval before posting or deleting. Prefer an environment variable or a credential manager over the helper's plaintext setup storage, and rotate the key if it may have been exposed in shell history or a shared workspace.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
6. Delete a Post
text DELETE /posts/<post_id>Only works on posts with status
pendingordraft. Scheduled and published posts cannot be deleted.
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill declares access to sensitive environment data via POSTMOORE_API_KEY but does not define an explicit tool scope or allowed-tools boundary. In an agent ecosystem, that omission can let the skill invoke capabilities more broadly or opaquely than users expect, reducing reviewability and increasing the chance of unintended secret use during live posting operations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill is explicitly designed to autonomously publish content to external social platforms, including immediate posting, but does not present a strong warning or confirmation requirement for live actions. That creates a real risk of accidental or prompt-induced publication to public accounts, causing reputational, legal, or business harm that is hard to reverse.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The recommended workflow directs the agent to inspect user-supplied video content, derive contextual information from it, and upload the media to a third-party service without any explicit privacy or consent warning. This is dangerous because videos may contain sensitive personal, biometric, location, or confidential business data, and once uploaded to an external platform the exposure may be difficult to control.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The setup command stores a live API key in plaintext on disk and does so without any warning, permission hardening, or guidance about safer alternatives. In the context of a social-posting automation skill, that key likely grants broad access to connected accounts, so local compromise, accidental backup sync, or repository inclusion could expose high-value credentials.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The posts:delete command issues an HTTP DELETE request for a post immediately after receiving an ID, with no confirmation prompt or cautionary user-facing notice. This is a destructive operation, and the surrounding help text only describes it functionally rather than warning that it deletes content.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The upload command reads a local file and sends its contents over HTTPS to the remote API, but the code provides no explicit disclosure at execution time that local file data will be transmitted. While uploading is part of the command's purpose, there is no warning or notice about the data transfer itself.
- Content
Static analysis
No suspicious patterns detected.