Metricool

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 6:56 AM UTC
• Version: 1.0.0

Overview

This is a straightforward Metricool social media scheduling skill, with expected API credential use and no evidence of hidden persistence, code execution, or unrelated data access.

Install only if you intend to let the skill use your Metricool token to read brands, view scheduled posts, retrieve analytics, and create scheduled social media posts. Use least-privilege Metricool credentials where possible, keep unrelated secrets out of the workspace .env file, and always specify blogId so the wrong brand is not selected automatically.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (18)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The documented purpose understates the skill's effective capabilities by omitting local credential/config access and brand discovery behavior. That mismatch is dangerous because users and policy systems may approve the skill for simple posting while it also touches sensitive local state and performs additional API enumeration.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence
• Finding: The documented purpose understates the skill's effective capabilities by omitting local credential/config access and brand discovery behavior. That mismatch is dangerous because users and policy systems may approve the skill for simple posting while it also touches sensitive local state and performs additional API enumeration.

Credential Access

High

• Category: Privilege Escalation

Content

if (!token) {
    try {
      const envPath = path.join(__dirname, '..', '..', '..', '.env');
      const envContent = fs.readFileSync(envPath, 'utf8');
      envContent.split('\n').forEach(line => {
        const [key, ...valueParts] = line.split('=');

• Confidence: 87% confidence
• Finding: The script reads credentials from a relative .env file on disk, which broadens secret access beyond the process environment and can unintentionally pull in unrelated repository secrets. In an agent skill context, this is more dangerous because the skill may run in a workspace containing other credentials, creating unnecessary exposure if the file is modified, reused, or later extended to log or transmit loaded values.

Credential Access

High

• Category: Privilege Escalation

Content

if (!token) {
    try {
      const envPath = path.join(__dirname, '..', '..', '..', '.env');
      const envContent = fs.readFileSync(envPath, 'utf8');
      envContent.split('\n').forEach(line => {
        const [key, ...valueParts] = line.split('=');

• Confidence: 94% confidence
• Finding: Reading ../../../.env is a credential-access pattern that can pull secrets from a broader project or parent workspace than necessary, potentially capturing unrelated tokens stored for other tools. In an agent setting this is especially risky because it turns a simple brand-listing action into generalized local secret discovery, increasing the blast radius if the skill is misused or modified.

Credential Access

High

• Category: Privilege Escalation

Content

if (!token) {
    try {
      const envPath = path.join(__dirname, '..', '..', '..', '.env');
      const envContent = fs.readFileSync(envPath, 'utf8');
      envContent.split('\n').forEach(line => {
        const [key, ...valueParts] = line.split('=');

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

} catch (e) {}
  }
  
  // Try .env file
  if (!token) {
    try {
      const envPath = path.join(__dirname, '..', '..', '..', '.env');

• Confidence: 90% confidence
• Finding: Referencing and reading a parent-directory .env file is credential access behavior because .env files commonly contain unrelated application secrets. In this skill context, probing for .env broadens access to credentials outside the Metricool integration and may unintentionally consume secrets from the host workspace.

Credential Access

High

• Category: Privilege Escalation

Content

// Try .env file
  if (!token) {
    try {
      const envPath = path.join(__dirname, '..', '..', '..', '.env');
      const envContent = fs.readFileSync(envPath, 'utf8');
      envContent.split('\n').forEach(line => {
        const [key, ...valueParts] = line.split('=');

• Confidence: 90% confidence
• Finding: The actual read of the repository-level .env file confirms the script is ingesting local secrets from disk rather than only using runtime-provided credentials. In an agent setting, this is dangerous because it can bypass operator expectations and normalize broad secret access from the working tree.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The README explicitly promotes scheduling and managing posts to external social media platforms but does not clearly warn that using the skill will queue or publish content on third-party accounts. In an agent setting, that omission is risky because users may treat the skill as a harmless analyzer rather than an action-taking integration, increasing the chance of unintended outbound posting and reputational damage.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill documents use of environment-based credentials but does not declare any tool scope or permissions that would make this sensitive capability explicit. In an agent setting, undeclared access to secrets or local configuration reduces transparency and can cause the skill to read credentials without clear user awareness or policy enforcement.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The scheduling instructions do not clearly warn that running the command will create posts on external social platforms using stored credentials. In an agent workflow, this can lead to unintended publication, reputational harm, or accidental use of the wrong brand/account because the action is externally side-effecting and not framed as such.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script actively reads Metricool credentials from multiple local secret sources, including a user config file and a repository-level .env file, broadening the set of places from which sensitive tokens may be harvested. In an agent-skill context, this is dangerous because invoking the skill implicitly grants code access to secrets unrelated to the immediate command, and the user is not clearly warned that local credential material will be read.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The script transmits an authentication token and user identifier to a remote API endpoint, which is expected for functionality but still constitutes sensitive secret use and external data egress. In a skill ecosystem, this is a real risk because a user may trigger the tool without realizing their local credentials will be used to contact an external service on their behalf.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The manifest describes scheduling/managing posts and analyzing social metrics via the Metricool API. While using credentials is expected, this file goes beyond direct API use by probing local files under the user's home directory and a parent-project .env file to obtain secrets, which is a separate local file access capability not stated in the skill purpose.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: The script forces the timezone to America/Chicago and formats dates using the en-US locale, with no option for user choice or documented justification. This is a natural-language policy concern because it imposes a specific locale/region behavior on all users rather than offering opt-in or configurability.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script accesses sensitive token material from disk without prominently disclosing that behavior to the caller, which is risky for an agent skill expected to operate with least surprise. Hidden secret discovery increases the chance of unauthorized credential use and makes review and consent harder, especially when the skill may run in varied local environments.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The script silently falls back to reading Metricool credentials from ~/.moltbot/moltbot.json and a repository-adjacent .env file, expanding the trust boundary beyond explicit environment variables. In an agent/skill context, this can cause unintended credential harvesting from local disk and use secrets the operator did not mean to expose to this specific script.

Context-Inappropriate Capability

Low

• Confidence: 86% confidence
• Finding: The manifest describes scheduling posts, checking scheduled posts, and analyzing social metrics via the Metricool API. In addition to using environment variables, this script probes ~/.moltbot/moltbot.json and a repository-relative .env file to obtain credentials, which is a separate local-file access capability not justified by the stated skill purpose.

Missing User Warnings

Low

• Confidence: 92% confidence
• Finding: This code reads sensitive Metricool credentials from environment variables, a user config file, and a local .env file, but the only visible comment/docstring describes listing scheduled posts and does not disclose that credential sources will be accessed. Under the code-file criteria, access to sensitive environment variables or credentials should have some visible disclosure unless clearly covered by the skill description, which is not present in this file.

Static analysis

No suspicious patterns detected.