Skills faceless Audit History

📦

Audit History

faceless - 1 audit

Audit version 1 Latest

Aug 20, 2026, 01:24 AM

Most static findings are documentation false positives: API examples target Faceless.so, key references support authentication, and Markdown backticks are not Ruby execution. One unpinned npm execution risk is confirmed, and workflows lack explicit confirmation before credit charges or public posting.

4

Files scanned

1,409

Lines analyzed

6

Review items

0

False positives ignored

Confirmed security concerns (1)

Medium

SKILL.md:79-83 references/workflows.md:49-57

Paid and Public Actions Lack Confirmation Guardrails

Workflows charge credits and publish or automate social content without requiring confirmation of cost, destination account, platform, schedule, or visibility.

The cited workflows explicitly charge credits, publish immediately, and enable recurring auto-posting, but they specify no final confirmation step.

Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

Ruby/shell backtick execution

2. If not found, install it: `npm install -g faceless-cli` (or use `npx -y faceless-cli <command>` w

The skill installs or executes the latest unpinned faceless-cli package. A compromised release could execute arbitrary code without confirmation.

Risk Factors

📁 Filesystem access (2)

README.md:13 README.md:13

🔑 Env variables (33)

README.md:20 references/api-reference.md:28 references/api-reference.md:44 references/api-reference.md:80 references/api-reference.md:141 references/api-reference.md:188 references/api-reference.md:229 references/api-reference.md:270 references/api-reference.md:320 references/api-reference.md:356 references/api-reference.md:398 references/api-reference.md:430 references/api-reference.md:462 references/api-reference.md:528 references/api-reference.md:563 references/api-reference.md:598 references/api-reference.md:664 references/api-reference.md:698 references/api-reference.md:729 references/api-reference.md:766 references/api-reference.md:820 references/api-reference.md:863 references/api-reference.md:899 references/api-reference.md:937 references/api-reference.md:974 references/api-reference.md:1012 references/api-reference.md:1052 references/api-reference.md:1101 references/api-reference.md:1144 SKILL.md:24 SKILL.md:114 SKILL.md:123 SKILL.md:126

🌐 Network access (42)

references/api-reference.md:27 references/api-reference.md:79 references/api-reference.md:140 references/api-reference.md:187 references/api-reference.md:190 references/api-reference.md:228 references/api-reference.md:269 references/api-reference.md:286 references/api-reference.md:319 references/api-reference.md:355 references/api-reference.md:397 references/api-reference.md:429 references/api-reference.md:461 references/api-reference.md:474 references/api-reference.md:527 references/api-reference.md:562 references/api-reference.md:597 references/api-reference.md:663 references/api-reference.md:697 references/api-reference.md:728 references/api-reference.md:765 references/api-reference.md:819 references/api-reference.md:833 references/api-reference.md:862 references/api-reference.md:898 references/api-reference.md:936 references/api-reference.md:973 references/api-reference.md:1011 references/api-reference.md:1024 references/api-reference.md:1051 references/api-reference.md:1100 references/api-reference.md:1103 references/api-reference.md:1113 references/api-reference.md:1143 references/workflows.md:70 SKILL.md:25 SKILL.md:71 SKILL.md:115 SKILL.md:116 SKILL.md:123 SKILL.md:126 SKILL.md:129

⚙️ External commands (50)

Audited by: codex

← Back to Skill