Security audit
Security checks for vulnerabilities and agentic risk
The skill matches its social-posting purpose, but it can publish or remove public content and suggests unpinned CLI/API paths that deserve user review before installation.
Install only if you trust xpost with the connected social accounts and media you provide. Prefer the MCP connector over the CLI fallback, avoid bare unpinned npx commands in sensitive environments, and require clear confirmation of destination, timing, and content before publishing, bulk posting, editing, deleting, or taking down live posts.
The manifest description says to use the skill whenever asked to post, schedule, cross-post, or take down social content, which is broad enough to trigger high-impact external actions from loosely related user requests. Overbroad invocation criteria increase the chance of accidental posting, deletion, or account operations without sufficiently explicit user confirmation.
The skill instructs the agent or user to run npx xpost without pinning a package version or integrity hash, which can fetch and execute whatever code is currently published under that package name. If the npm package is compromised, typosquatted, or updated maliciously, this becomes arbitrary code execution in the local environment.
This unpinned npx xpost invocation relies on the latest package state at execution time, creating a supply-chain execution risk. Because npx downloads and runs code, compromise of the package or its dependencies could yield immediate code execution with the caller's privileges.
The command example uses npx xpost without constraining the resolved artifact, exposing users to remote code execution via npm supply-chain compromise. Since the skill is operational and intended for posting workflows, users may execute these commands directly, increasing practical exploitability.
An unversioned npx command causes execution of code selected at runtime from the npm registry, not a reviewed artifact. In a skill that handles authentication and social-account operations, compromise could also expose tokens, account metadata, or permit unauthorized posting.
This example continues the pattern of dynamically executing an npm package without a fixed version, leaving users vulnerable to malicious or unintended upstream changes. The risk is especially relevant because the command is associated with media upload and posting actions that may involve local files and authenticated sessions.
The skill provides another unpinned npx xpost command, which implicitly trusts the current registry state and package publisher. That creates a repeatable path to arbitrary code execution and possible credential theft or environment compromise.
This invocation is vulnerable for the same reason as the other npx xpost references: the command resolves and executes mutable remote code. In environments where XPOST_API_KEY is configured, a compromised CLI could exfiltrate secrets or manipulate posts.
Using npx xpost here preserves the same supply-chain risk profile: runtime retrieval of unpinned executable code. Because this command edits posts, successful compromise could alter content, schedule, or approval-related state in addition to host compromise.
This unpinned npx usage can execute a maliciously updated package and thereby compromise the host or authenticated xpost session. The danger is not theoretical because npm ecosystem compromises commonly target high-trust copy-paste install and run flows.
The final CLI example also executes an unpinned npm package, creating a consistent supply-chain execution weakness throughout the skill. Since this command retrieves delivery receipts, a compromised package could harvest account information and tokens even in ostensibly read-oriented operations.
The workflow explicitly permits omitting scheduled_at, causing a post to go out immediately, and also allows 'next_slot' queueing based on inferred intent like 'queue it' or asks with no time. For a skill that can publish to multiple social networks, this is autonomous decision-making with external side effects and reputational impact if the user's intent is misunderstood.
schedule — it fits "queue it", and any ask with no time behind it where
`get_project` shows `queue.configured: true` (its `next_slots` are what
they will get). Refused as `no_queue_slots` where there is no schedule,
and a time then has to come from the person. `is_draft: true` files a scratchpad draft — no queue, no
approval link; the person sends it from its page. Per-account words and
options go in `platform_configurations`, keyed by platform:
`{"x": {"caption": "shorter", "first_comment": "…", "thread": ["…"]}}`,
No suspicious patterns detected.