social-poster
Pass
Audited by Gen Agent Trust Hub on Jun 18, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXFILTRATION]: The skill transmits user-provided content to official API endpoints for X (
api.x.com) and LinkedIn (api.linkedin.com). This behavior is the stated primary purpose of the skill and targets well-known services. - [CREDENTIALS_UNSAFE]: The tool manages sensitive OAuth tokens (
X_BEARER_TOKENandLINKEDIN_ACCESS_TOKEN) via environment variables. It includes a security-enhancingmaskAuthfunction that ensures tokens are truncated to their last four characters in console output to prevent accidental leakage during debugging or dry runs. - [COMMAND_EXECUTION]: The skill operates via a Bun script (
scripts/post.ts). While it is invoked through the command line, it does not allow for arbitrary command injection; flags are parsed strictly to define platform parameters and post content.
Audit Metadata