Security audit

Powerpost

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed PowerPost integration that can create and publish social media content, so it is appropriate if users understand the account and credit impact.

Install only if you are comfortable giving PowerPost access to connected social accounts and sending prompts, media, URLs, and generated content to its service. Prefer a draft-only or read-only API key unless you intentionally want the agent to publish or schedule posts, and review every draft before approving publication.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The changelog states that user-supplied source_urls are scraped by the AI for research context, but it provides no warning that submitted URLs may trigger external fetches and transfer page contents into downstream AI processing. In a social-media publishing skill, users may submit internal, sensitive, or third-party URLs without realizing the privacy, consent, and data-handling implications, which can expose confidential content or create compliance issues.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The description emphasizes automation and convenience but does not prominently warn that the skill can publish to connected accounts, schedule or cancel posts, and consume paid credits. Users may enable or invoke the skill without understanding the operational and financial consequences, raising the risk of unintended posting, reputation damage, and unexpected charges.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 25)May include surrounding context.
md
## What you need - A PowerPost account ([sign up here](https://powerpost.ai)) - An API key ([create one here](https://powerpost.ai/settings/api)) - Your workspace ID ([find it here](https://powerpost.ai/settings/workspaces)) - At least one connected social account ([connect here](https://powerpost.ai/settings/connections))

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The example phrases are broad, conversational, and overlap with common user speech, including ambiguous requests like scheduling, cancellation, analytics, and calendar operations. In an agentic environment, this can cause accidental routing to the skill or execution of consequential actions on connected accounts from loosely phrased prompts.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The README advertises calendar operations like viewing, moving, and deleting entries, which are unrelated to the stated social-media-posting purpose. Broadening the natural-language command surface into adjacent personal productivity domains increases the chance of unintended invocation, user confusion, and over-privileged integrations if the agent interprets ordinary calendar requests as in-scope skill actions.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.
Use this to check how many credits the user has before starting any generation.

bash
curl https://powerpost.ai/api/v1/account/credits \ -H "x-api-key: $POWERPOST_API_KEY"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 267)May include surrounding context.
After starting a generation, poll this endpoint every 2-3 seconds until status is completed or failed. Do not poll more than 60 times (about 2 minutes).

bash
curl https://powerpost.ai/api/v1/content/generations/GENERATION_ID \ -H "x-api-key: $POWERPOST_API_KEY" \ -H "X-Workspace-Id: $POWERPOST_WORKSPACE_ID"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 532)May include surrounding context.
Poll this endpoint every 10 seconds until status is completed or failed. Video generation takes longer than images — do not poll more than 120 times.

bash
curl https://powerpost.ai/api/v1/videos/generations/VIDEO_GENERATION_ID \ -H "x-api-key: $POWERPOST_API_KEY" \ -H "X-Workspace-Id: $POWERPOST_WORKSPACE_ID"

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The command examples include phrases like "Post about X" and "Create a post about X," which are common natural language requests and are not bounded to a specific tool context. Without explicit exclusion conditions or a narrower activation contract, these examples could cause unintended invocation during ordinary conversation about posting content.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Phrases like "Create an image" and "Generate an image of X" are broad, everyday requests that could appear in many unrelated contexts. The document does not provide explicit constraints or negative examples to distinguish when this skill should activate versus when another image or design workflow should handle the request.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The listed triggers "Create a video" and "Generate a video of X" are generic user utterances that can occur in many unrelated workflows. Because the skill does not define a confined invocation context or exclusion cases, these triggers risk accidental activation.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 924)May include surrounding context.
Use this to pull up what's on the user's content calendar.

bash
curl "https://powerpost.ai/api/v1/calendar/entries?start_date=2026-03-01&end_date=2026-03-31" \ -H "x-api-key: $POWERPOST_API_KEY" \ -H "X-Workspace-Id: $POWERPOST_WORKSPACE_ID"

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: Publishing trigger examples like 'Publish my post' or 'Send it live' are common conversational phrases that could be matched outside a clearly bounded tool-selection context. Because this skill can perform real-world, irreversible actions against connected social accounts, ambiguous routing increases the risk of unintended publication if the surrounding agent incorrectly invokes the skill.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.