substack
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local Python script (
scripts/substack.py) via the Bash tool to perform operations on the user's Substack account.- [CREDENTIALS_UNSAFE]: The skill utilizes a sensitive environment variable (SUBSTACK_COOKIES) for authentication. The script includes logic to ensure cookies are only sent to appropriate domains and the instructions explicitly forbid the agent from printing the variable's contents.- [EXTERNAL_DOWNLOADS]: The skill makes network requests tosubstack.comandauth.acedata.cloud(the author's authentication service) to retrieve publication data and publish posts. These are legitimate targets for the skill's stated purpose.
Audit Metadata