buffer
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of the official Buffer CLI via standard package managers. Specifically, it provides instructions to install
@bufferapp/cliglobally usingnpmor to execute it dynamically usingnpx. These are established methods for interacting with the Buffer service. - [COMMAND_EXECUTION]: The skill relies on shell command execution to interface with the
bufferCLI. It defines workflows for account inspection, post scheduling, and drafting ideas. These commands are executed within the user's local shell environment as part of the intended functionality. - [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: The skill ingests external data from the Buffer API through commands like
buffer channels list,buffer account, andbuffer posts list, which could potentially contain untrusted content if the account is compromised. - Boundary markers: The instructions do not define specific delimiters or "ignore" warnings for the tool's output.
- Capability inventory: The skill has the capability to write to the file system (via
buffer init) and perform network operations via the CLI. - Sanitization: There is no explicit sanitization step mentioned for the data retrieved from the API before it is processed by the agent's context.
Audit Metadata