post-bridge
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill is designed to interact with the vendor's official API (
api.post-bridge.com). All network communications and media uploads are directed to this infrastructure. - [COMMAND_EXECUTION]: The skill documentation includes an optional video workflow that utilizes
ffmpegfor frame extraction. These instructions are safety-conscious, requiring the agent to inform the user before running commands and to seek approval for file movements or the creation ofcronjobs. - [CREDENTIALS_UNSAFE]: The included CLI script manages the
POST_BRIDGE_API_KEY. It correctly implements secure storage by setting restrictive file permissions (0o600) and instructs the agent to obtain the key from the user via a setup command rather than searching local files. - [EXTERNAL_DOWNLOADS]: The skill uses
npx postbridge-clito run the vendor-provided CLI tool. This is a standard and safe distribution method for the author's own software. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-generated captions and data returned from the Post Bridge API (such as analytics). The risk of malicious instructions in this data is mitigated by the skill's specific focus on social media posting and the requirement for user confirmation before live publishing.
Audit Metadata