Security audit
Security checks for vulnerabilities and agentic risk
The skill is a straightforward Repliz API reference, but it enables public posting, comment replies, and irreversible scheduled-post deletion without documented confirmation safeguards.
Install only if you are comfortable giving the agent Repliz API credentials that can manage connected social accounts. Before using it, require the agent to list the exact account, post, comment, or schedule item and ask for explicit confirmation before posting, replying, or deleting anything.
The DELETE /public/schedule/{_id} endpoint gives the skill direct authority to remove scheduled posts, which is a powerful state-changing capability. Without strict confirmation, scoping, and validation of the target ID, an agent could be manipulated into deleting arbitrary scheduled content across connected accounts.
}
**DELETE /public/schedule/{_id}**
- Delete scheduled post (cannot be recovered)
---
The skill enables actions that can publish content to connected social media accounts and reply publicly to comments, but the top-level description does not prominently warn users about these outward-facing, reputation-affecting effects. This increases the chance of accidental posting or engagement when an agent invokes the skill with insufficient user awareness or confirmation.
The skill documents an irreversible deletion endpoint but only notes the consequence inline, without a prominent safety warning or confirmation requirement. In an agent setting, this creates a real risk of accidental or unauthorized deletion of scheduled content, causing operational and reputational harm.
No suspicious patterns detected.