social-autoposter
Pass
Audited by Gen Agent Trust Hub on Jul 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONCREDENTIALS_UNSAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches developer tools and automation libraries from established sources, including the 'uv' Python tool from astral.sh and the 'browser-harness' project from GitHub.
- [COMMAND_EXECUTION]: Utilizes shell commands and Python subprocesses to manage browser profiles, execute automated interactions, and install persistent background services via launchd (macOS) and systemd (Linux).
- [DATA_EXFILTRATION]: Transmits an 'X-Installation' telemetry header to the author's API at s4l.ai, containing machine metadata and git configuration identifiers as detailed in the project's PRIVACY.md.
- [CREDENTIALS_UNSAFE]: Accesses a sensitive environment configuration file in a sibling project's directory (~/fazm/web/.env.local) to retrieve third-party API credentials for transcription functionality.
- [COMMAND_EXECUTION]: Implements self-healing and anti-tampering mechanisms, such as clearing stale browser locks and enforcing macOS immutable flags (uchg) on critical pipeline scripts to prevent unintended modifications.
Audit Metadata