Social Scheduler Pro Free

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:19 AM UTC
• Version: 1.0.0

Overview

This social-media planning skill is mostly a content-generation guide, but it requests general command execution and suggests running network diagnostics that do not fit its stated purpose.

Review before installing. The content-planning features are straightforward, but the skill should not need unrestricted command execution; use it only in a sandboxed agent or after removing exec and replacing ping troubleshooting with ordinary user-facing connectivity advice. Confirm any export or save destination before allowing file writes.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:5

Finding

Unnecessary General Command Execution Capability

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:5
Vulnerability Type: Excessive tool permissions violating least privilege
Risk Level: Medium

yaml

allowed-tools: read exec

Technical Analysis

The skill grants the agent access to the general-purpose exec tool even though its declared core functions are limited to generating social-media calendars, drafts, content pillars, and hashtag strategies. These text-generation operations do not inherently require local command execution.

General command execution materially expands the skill's authority beyond its legitimate requirements. If untrusted content or prompt-injection text influences the agent while this skill is active, the unnecessary exec permission could provide a path from instruction manipulation to operating-system command execution.

The reviewed file does not directly instruct the agent to execute a malicious command, retrieve a payload, access credentials, or establish persistence. Exploitation therefore depends on a separate instruction-manipulation vector and on the behavior of the hosting agent. The vulnerability is the excessive permission boundary rather than evidence of an embedded malicious payload.

Attack Path

1. The host loads the skill and grants the tools declared by allowed-tools.
2. The agent receives untrusted social-media content, copied source material, or another input containing adversarial instructions.
3. The adversarial instructions attempt to redirect the agent from content generation to invoking the available exec tool.
4. If the host does not independently enforce command restrictions or require user confirmation, the agent may execute a local command with the privileges of the agent process.
5. The resulting access is limited by the operating-system account, sandbox, filesystem permissions, and network controls applied to that process.

Impact Assessment

Successful exploitation could permit co ...[truncated 567 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove exec from allowed-tools and retain only the minimum tools required for text generation:

   yaml

   allowed-tools: read
   

2. Reclassify the skill as Markdown-only rather than command-execution capable.
3. Replace command-based network troubleshooting with a message directing users to verify connectivity outside the skill.
4. If command execution is later required for a legitimate feature, expose narrowly scoped operations instead of unrestricted shell access.
5. Require explicit user approval before any command runs, apply an executable and argument allowlist, and reject shell metacharacters or dynamically constructed commands.
6. Run the agent in a restricted sandbox with minimal filesystem access, no unnecessary credentials in environment variables, and deny-by-default network access.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill name, description, headings, examples, and instructions are all presented in Chinese, with no indication that users may request another language. Under the policy, forcing a specific language without opt-in is a natural-language policy concern unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The description says the skill covers broad scenario keywords such as '需要生成营销文案、写作内容、标题优化、内容创作时使用', which overlap with common, everyday writing requests rather than narrowly scoped social-media scheduling tasks. It does not provide explicit activation boundaries or negative examples beyond one brief exclusion, so the invocation scope remains unclear.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill declares allowed-tools: read exec and the error-handling section explicitly instructs the agent to run ping for network diagnostics, even though the skill’s stated purpose is social-media planning and draft generation. This expands behavior into shell execution unrelated to the core task, increasing the chance of unnecessary command execution, environment probing, or unsafe operator trust in a content-only skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill states that result handling supports '导出/保存/转换操作', which implies writing data to files or other persistent outputs. The document does not warn users that these actions may create or overwrite local files, nor does it mention confirming paths or reviewing output destinations first.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The documentation claims no extra API keys are needed and that the free version does not perform direct publishing, yet nearby sections assume runtime network-command troubleshooting. This inconsistency can mislead operators into granting or tolerating network-capable execution for a skill that should be purely instructional, weakening least-privilege expectations and normalizing unnecessary system interaction.

Content

No source excerpt is available for this finding.