posting-to-atproto
Warn
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: MEDIUMCREDENTIALS_UNSAFEDATA_EXFILTRATIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [Data Exposure & Exfiltration] (MEDIUM): The script
scripts/publish-greengale.pyaccepts a--fileargument and reads the specified file's contents into a variable which is then uploaded to an external server. This creates a risk where an attacker could trick the agent into reading and publishing sensitive local files such as SSH keys or environment configurations. - [Credentials Unsafe] (LOW): The skill manages ATProtocol authentication using credentials like
ATPROTO_APP_PASSWORDfrom environment variables. While necessary for the protocol, these are sensitive secrets. - [Indirect Prompt Injection] (LOW): The skill is vulnerable to indirect injection because it processes untrusted file content for publication without sanitization. 1. Ingestion points:
--fileand--contentarguments inpublish-greengale.py. 2. Boundary markers: Absent. 3. Capability inventory: Network POST requests to external PDS. 4. Sanitization: Only character count truncation is performed. - [Remote Code Execution] (LOW): The
SKILL.mdfile mentions a script namedtools/thread.pywhich is not included in the provided files, making its behavior unverifiable.
Audit Metadata