cali-social-publish
Pass
Audited by Gen Agent Trust Hub on Jul 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/generate_variants.pycontains logic to execute other scripts (e.g.,x_post.py,linkedin_post.py) based on user-supplied configuration and LLM-generated recommendations. While intended for automation, this creates a path where generated content influences script execution flow. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8). It ingests data from external URLs via
requests.getinscripts/generate_variants.pyand passes it directly to the Anthropic API to generate social media posts. An attacker could embed malicious instructions in a webpage to hijack the agent's tone or content. Mitigation: The skill includes a 'review' mode by default and uses boundary markers in its prompt ('Reference: ---') to separate untrusted data. - [EXTERNAL_DOWNLOADS]: The skill fetches content from arbitrary user-provided URLs in
scripts/generate_variants.py. This is part of its core functionality for content creation but involves processing untrusted external data. - [CREDENTIALS_UNSAFE]: While the skill manages sensitive API keys and tokens, it follows best practices by instructing users to use environment variables (
X_API_KEY,LINKEDIN_CLIENT_SECRET) and storing generated tokens in the user's home directory (~/.social-publish/) rather than hardcoding them.
Audit Metadata