Skills/PyPI/omnipress-mcp

omnipress-mcp@0.3.0

CAUTION· startup only

Publisher claims: "Agentic multi-channel publishing engine for Antigravity via Model Context Protocol (MCP)" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry PyPI (MCP server)Publisher ismaelsoilet · publishing for 30 daysInstalls 430Last detonated 22 h ago
What would fix thisWatchDispute verdict

Coverage

Startup only; authenticated tool behavior not tested.
Tested
server startup over stdio (initialize sent) · every file read, file written and host contacted by what ran
Not tested
the tool list (the server exited before answering) · what the tools do when called with real credentials

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
BUFFER_ACCESS_TOKENBUFFER_API_KEYDEVTO_API_KEYGHOST_ADMIN_API_KEYINSTAGRAM_ACCESS_TOKENOMNIPRESS_WEBHOOK_SECRETOMNIPRESS_WEBHOOK_URLREDDIT_CLIENT_SECRETREDDIT_PASSWORDYOUTUBE_WEBHOOK_URLConfiguration, not credentials: ARTICLES_DIR, BUFFER_INSTAGRAM_PROFILE_ID, BUFFER_LINKEDIN_PROFILE_ID, BUFFER_THREADS_PROFILE_ID, BUFFER_X_PROFILE_ID, DEVTO_API_URL, FFMPEG_PATH, GHOST_API_URL, INSTAGRAM_ACCOUNT_ID, INSTAGRAM_BUSINESS_ACCOUNT_ID, MEDIA_STAGING_DIR, OMNIPRESS_ACTIVE_CHANNEL, OMNIPRESS_MODE, OMNIPRESS_PUBLIC_URL, R2_BUCKET_NAME, R2_ENDPOINT_URL, R2_PUBLIC_URL_PREFIX, REDDIT_CLIENT_ID, REDDIT_DEFAULT_SUBREDDIT, REDDIT_USERNAME, S3_ACL, S3_BUCKET_NAME, S3_ENDPOINT_URL, S3_PUBLIC_URL_PREFIX
Where it talks to
no vendor host named in the codeAlso buffer.com, bufferapp.com, dev.to, facebook.com, instagram.com, reddit.com, ghost.io, catbox.moe — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
the tool list (the server exited before answering) · what the tools do when called with real credentials

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names buffer.com, bufferapp.com, dev.to, facebook.com, instagram.com, reddit.com, ghost.io, catbox.moe as well as its own vendor. The guard injects BUFFER_ACCESS_TOKEN, BUFFER_API_KEY, DEVTO_API_KEY, GHOST_ADMIN_API_KEY, INSTAGRAM_ACCESS_TOKEN, OMNIPRESS_WEBHOOK_SECRET, OMNIPRESS_WEBHOOK_URL, REDDIT_CLIENT_SECRET, REDDIT_PASSWORD, YOUTUBE_WEBHOOK_URL only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- uvx omnipress-mcp

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; startup only; authenticated tool behavior not tested) on 2026-11-13 and scored it 75/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 35 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
14sprocessdependency install exit 0
34sclaimedstartup only: exited (0) before answering · code: 'ERR_MODULE_NOT_FOUND', url: 'file:///tmp/ks-detonate-Qyv4hz/task/home/work/acme-api/.claude/skills/omnipress-mcp/src/video/Root' } Node.js v22.23.5
34sprocessscript backend runs setup only
34sprocessno install scripts to re-run

Static findings

HIGH
Access to sensitive file pathsAGENTS.md:39 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files- **Dynamic Configuration**: Publisher adapters resolve credentials and channel IDs (e.g., `buffer_channel_id`) dynamically from `channel.json` before falling back to `.env`.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsAGENTS.md:98 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files- **Zero Segredos no Código**: Jamais insira chaves de API, IDs de perfis ou tokens no código-fonte. Sempre utilize variáveis de ambiente via `.env`.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actionAGENTS.md:117 · File type combined with upload action — agent may exfiltrate local data files…de exclusivamente em sua pasta em `channels/<slug>/` com seu respectivo `channel.json`, `articles/`, `media/` (`raw/`, `carousels/`, `stories/`, `visuals/`, `voiceover/`, `soundtrack/`, `output/`), `documentarios/`, `shorts/` e `scripts/`.…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Access to sensitive file pathssrc/cli.py:65 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv_file = PROJECT_ROOT / ".env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/cli.py:64 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"""Interactive onboarding wizard to configure .env credentials cleanly."""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsAGENTS.md:120 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files- **Configuração Dinâmica**: Adaptadores de publicação resolvem IDs de canal (ex.: `buffer_channel_id`) diretamente de `channel.json` antes de consultar `.env`.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/adapters/webhook_adapter.py:51 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"error": "OMNIPRESS_WEBHOOK_URL is not configured in .env",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/adapters/buffer_adapter.py:208 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"error": "BUFFER_API_KEY or BUFFER_ACCESS_TOKEN is not configured in .env",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/adapters/reddit_adapter.py:58 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"error": "Reddit credentials (REDDIT_CLIENT_ID, REDDIT_CLIENT_SECRET, REDDIT_USERNAME, REDDIT_PASSWORD) not configured in .env",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
URL with embedded credentialssrc/video/compositions/ThumbnailEpisode.tsx:38 · URL with embedded credentials — may be phishing or credential leaking@import url('https://fonts.googleapis.com/css2?family=Anton&family=Cinzel:wght@800;900&family=Montserrat:wght@800;900&display=swap');Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
File type combined with upload actionscripts/setup_claude.js:121 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(' - omnipress_queue_post');Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionAGENTS.md:36 · File type combined with upload action — agent may exfiltrate local data files…tion must live in its own directory under `channels/<slug>/` containing `channel.json`, `articles/`, `media/` (`raw/`, `carousels/`, `stories/`, `visuals/`, `voiceover/`, `soundtrack/`, `output/`), `documentarios/`, `shorts/`, and `scripts…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionsrc/adapters/buffer_adapter.py:331 · File type combined with upload action — agent may exfiltrate local data filesdata = res.json().get("data", {}).get("createPost", {})Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Access to sensitive file pathssrc/cli.py:16 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesload_dotenv(PROJECT_ROOT / ".env")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/omnipress_publisher.py:29 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesload_dotenv(PROJECT_ROOT / ".env")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/setup_claude.js:24 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst envPath = path.join(projectRoot, '.env');Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/cli.py:66 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesexample_file = PROJECT_ROOT / ".env.example"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/omnipress_carousel.py:30 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesload_dotenv(PROJECT_ROOT / ".env")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/server.py:15 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesload_dotenv(PROJECT_ROOT / ".env")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actionAGENTS.md:82 · File type combined with upload action — agent may exfiltrate local data files- **Universal Engine Invocations**: Standard deliverables must use declarative JSON recipes (`carousel_recipe.json`, `post_recipe.json`) executed by core universal engines:Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Access to sensitive file pathssrc/cli.py:73 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesprint(f"ℹ️ Creating fresh .env from .env.example...")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/adapters/instagram_adapter.py:48 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"error": "INSTAGRAM_ACCESS_TOKEN or INSTAGRAM_ACCOUNT_ID is not configured in .env",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actionAGENTS.md:85 · File type combined with upload action — agent may exfiltrate local data files- `omnipress align-captions <whisper.json> -o <output.json>` (Whisper timestamp standardization & 2-4 word chunking).Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionAGENTS.md:164 · File type combined with upload action — agent may exfiltrate local data files…os devem definir suas instruções em arquivos JSON declarativos (`carousel_recipe.json`, `post_recipe.json`), processados diretamente pelos motores universais em `src/engine/…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Access to sensitive file pathsscripts/setup_claude.js:81 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// Read .env if presentFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/omnipress_audio_master.py:30 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesload_dotenv(PROJECT_ROOT / ".env")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actionscripts/omnipress_carousel.py:13 · File type combined with upload action — agent may exfiltrate local data filespython scripts/omnipress_carousel.py --recipe path/to/recipe.json --upload --scheduleFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Access to sensitive file pathssrc/engine/universal_publisher.py:126 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"error": "Buffer publisher adapter is not configured in environment (.env).",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathsdocker-compose.yml:17 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files- .envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/server.py:398 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"ℹ️ No external provider configured in `.env` (BUFFER_ACCESS_TOKEN, REDDIT_CLIENT_ID, or OMNIPRESS_WEBHOOK_URL).\n"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedscripts/generate_cinematic_sfx.py:190 · Python subprocess execution detectedsubprocess.run(["ffmpeg", "-y", "-i", str(out), "-b:a", "192k", str(mp3_out)], check=False)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Destructive file system command detectedDockerfile:12 · Destructive file system command detected&& rm -rf /var/lib/apt/lists/*Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedsrc/utils/runtime_checker.py:17 · Python subprocess execution detectedout = subprocess.check_output([cmd, version_arg], stderr=subprocess.STDOUT, text=True, timeout=3)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/engine/dark_media.py:40 · Python subprocess execution detectedres = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File type combined with upload actionsrc/adapters/buffer_adapter.py:465 · File type combined with upload action — agent may exfiltrate local data filesdata = res.json().get("data", {}).get("deletePost", {})Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Python subprocess execution detectedsrc/engine/universal_audio.py:150 · Python subprocess execution detectedres = subprocess.run(cmd, check=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05

Cost to the agent

Instructions loaded
≈6,561 tok
2 files · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for omnipress-mcp@0.3.0 as of 21 h ago. This is the package itself, not its dependencies.

What would make this Verified

5 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim ismaelsoilet: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  3. URL with embedded credentials≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
  5. Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  6. Destructive file system command detected≈ +2 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
Publish a new version to PyPI, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim ismaelsoiletPropose a patch to the maintainer