substack
Pass
Audited by Gen Agent Trust Hub on Jul 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDATA_EXFILTRATIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Interacts with well-known Substack API endpoints (substack.com) to perform account actions like fetching profile data and publication history.
- [DATA_EXFILTRATION]: Retrieves session cookies from a secure environment variable for authentication and reads local files to extract article content for publishing. The script implements domain validation and prevents cookie leakage during HTTP redirects.
- [COMMAND_EXECUTION]: Uses the Bash tool to run a local Python script for publication management. The skill requires an explicit '--confirm' argument for any operation that modifies account data, acting as a manual safety gate.
Audit Metadata