Metricool

• Outcome: Review
• Latest audit: Jul 10, 2026 · 3:31 AM UTC
• Version: 1.0.0

Overview

The skill appears built for Metricool social scheduling, but it can immediately schedule public posts with stored credentials and may pick the first connected brand automatically.

Install only if you are comfortable giving this skill Metricool authority to schedule posts on connected social accounts. Prefer environment-injected credentials or a dedicated Metricool-only config, keep tokens out of committed .env files, pass an explicit blogId, and review the exact text, platforms, and scheduled time before running schedule-post.js.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill documents use of environment variables for sensitive credentials but does not declare corresponding permissions. This creates a transparency and governance gap: users or tooling may not understand that the skill depends on secret access, increasing the chance of unsafe execution or review bypass.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The script searches for Metricool credentials not only in the current process environment but also in local config and a repository-level .env file. This broad credential harvesting increases the chance of using secrets from unrelated contexts without the operator's awareness, which is especially risky in an agent skill that may run automatically and make outbound requests.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The script does not limit credential loading to explicit environment variables; it also reads from a user config file and a repository-adjacent .env file. That broadens secret access beyond the minimum needed and can unintentionally consume credentials from unrelated local contexts, increasing the risk of unauthorized secret use or accidental cross-project credential exposure.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The script searches multiple local locations for Metricool credentials, including a user home config and a repository-level .env file, even though a simple listing utility could rely on explicitly provided environment variables instead. This broad credential discovery increases the chance of unintentionally using secrets from unrelated contexts and normalizes secret harvesting behavior from local files.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The script performs credential discovery by reading secrets from unrelated local sources such as ~/.moltbot/moltbot.json and a project-root .env file instead of limiting itself to explicitly provided inputs. In an agent skill context, this broadens the script's authority and enables unintended secret access from the host environment, which is a real credential-access risk even if the values are only used for the Metricool API.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill instructs users to send post content and account-linked data to Metricool, a third-party social media service, without clearly warning that prompts, text, media URLs, scheduling metadata, and associated account information will leave the local environment. This can lead to unintended disclosure of sensitive or regulated content, especially if users assume the skill is purely local.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The setup guidance tells users to place an API token and email in local config or a workspace .env file without any credential-handling warning. This increases the risk of secret exposure through source control, shared workspaces, backups, logs, or overly broad filesystem access.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The code silently reads credentials from disk and immediately uses them in authenticated HTTPS requests without any user-facing disclosure or consent prompt. In an automation/agent context, this reduces transparency and can cause users to unknowingly expose local secrets or trigger authenticated actions against external services.

Credential Access

High

• Category: Privilege Escalation

Content

if (!token) {
    try {
      const envPath = path.join(__dirname, '..', '..', '..', '.env');
      const envContent = fs.readFileSync(envPath, 'utf8');
      envContent.split('\n').forEach(line => {
        const [key, ...valueParts] = line.split('=');

• Confidence: 95% confidence
• Finding: .env'

Credential Access

High

• Category: Privilege Escalation

Content

if (!token) {
    try {
      const envPath = path.join(__dirname, '..', '..', '..', '.env');
      const envContent = fs.readFileSync(envPath, 'utf8');
      envContent.split('\n').forEach(line => {
        const [key, ...valueParts] = line.split('=');

• Confidence: 95% confidence
• Finding: .env'

Credential Access

High

• Category: Privilege Escalation

Content

if (!token) {
    try {
      const envPath = path.join(__dirname, '..', '..', '..', '.env');
      const envContent = fs.readFileSync(envPath, 'utf8');
      envContent.split('\n').forEach(line => {
        const [key, ...valueParts] = line.split('=');

• Confidence: 88% confidence
• Finding: .env'

Credential Access

High

• Category: Privilege Escalation

Content

} catch (e) {}
  }
  
  // Try .env file
  if (!token) {
    try {
      const envPath = path.join(__dirname, '..', '..', '..', '.env');

• Confidence: 98% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

// Try .env file
  if (!token) {
    try {
      const envPath = path.join(__dirname, '..', '..', '..', '.env');
      const envContent = fs.readFileSync(envPath, 'utf8');
      envContent.split('\n').forEach(line => {
        const [key, ...valueParts] = line.split('=');

• Confidence: 98% confidence
• Finding: .env'

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.