postiz
Fail
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: HIGHCREDENTIALS_UNSAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The maintenance script 'scripts/screenshots/capture.mjs' contains a hardcoded email address and password. While these are intended for authenticating against a local, throwaway Postiz instance to generate documentation screenshots, hardcoding credentials in scripts is a high-risk security practice.
- [DYNAMIC_EXECUTION]: The synchronization script 'scripts/sync-facts.mjs' uses the 'eval()' function to dynamically parse and evaluate JavaScript/TypeScript object literals from local source code files to generate documentation tables.
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates workflows that ingest data from the Postiz API, such as list integrations and list posts. This data can include user-controlled content from multiple external social media platforms. The absence of sanitization, filtering, or explicit boundary markers in the skill's data processing instructions creates a surface where untrusted external content could potentially influence the AI agent's behavior.
Recommendations
- AI detected serious security threats
Audit Metadata