mupeng-social-postcjo

clawhub:mupeng-social-postcjo

View source
B
85/100

First Seen

Feb 18, 2026

Last Scanned

Feb 22, 2026

Findings

2

Score

85/100

HIGH 1
LOW 1

Findings (2)

HIGH
Read sensitive files and transmit externally
L63

Detects skills that both read sensitive credential files and send data to external services

Access Token & Secret + upload via Twitter API
FIX

Block access to git credentials, SSH keys, and repository tokens. If git operations are needed, use scoped deploy keys and restrict the tool to specific repositories.

FP?

Likely FP if the match is documentation about git configuration (e.g., setting up git credentials helper) rather than code that reads and transmits them.

LOW
Screenshot or screen capture with transmission
L238

Detects screenshot/screen capture tools combined with upload or transmission

screenshot + upload via Twitter API
FIX

Block the ability to read and transmit contents of configuration files (.env, config.json, settings.yaml). Implement file path validation to prevent access to sensitive config files.

FP?

Likely FP if the skill reads config files to configure itself locally without transmitting the contents externally.