Is Social Post Mate (Commenter AI partner) safe?

High risk

Social Post Mate is high risk. When you use grammar check or suggestions, Social Post Mate reads the comment text you're drafting in the social media editor and sends it to a Commenter AI endpoint, which returns grammar checks or suggestions.…

socialpostmatev5.0.3Chrome Web Store
75Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-200
SourceAI SANDBOX

Drafted social media comments sent to Commenter AI for grammar checks

When you use grammar check or suggestions, Social Post Mate reads the comment text you're drafting in the social media editor and sends it to a Commenter AI endpoint, which returns grammar checks or suggestions.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You request grammar checking or suggestions while drafting a social media comment.

The extension did this

The extension reads the drafted comment text and sends it to Commenter AI for processing.

02EvidenceNETWORK CAPTURE
Captured request
POSThttps://app.commenter.ai/plugin/comment-grammar
03EvidenceFIELD TABLE
Fields in the request
FieldValueWhy it matters
Drafted comment text
Looks good to me, thanks for sharing this update. (illustrative)The request includes text you have typed into the comment editor before posting, which can reveal message content and conversation context.
SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-200
SourceAI SANDBOX

Social post content sent to commenter.ai during comment generation

When you ask Social Post Mate to generate a comment, it collects the post text and sends it to commenter.ai.

The request can include selected keywords, mood/style settings, platform context, and referenced image or PDF URLs.

01EvidenceCAUSE EFFECT
What actually happens
You did this

The user clicks the generate or write comment button.

The extension did this

The extension reads social media post content and sends comment-generation inputs to commenter.ai.

02EvidenceNETWORK CAPTURE
Captured request
POSTcommenter.ai (via stored api URL)
03EvidenceFIELD TABLE
Fields in the request
FieldValueWhy it matters
Social post page content
A LinkedIn post about a product launch (illustrative)The text and context of the post being used to generate the comment can reveal what the user is viewing or responding to.
SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-359
SourceAI SANDBOX

Social posts and image URLs sent to commenter.ai on comment generation

When you generate a comment on X, Facebook, Instagram, or LinkedIn, Social Post Mate reads the visible post text from the page.

For Instagram posts, it also includes Instagram CDN image URLs in the request sent to commenter.ai.

01EvidenceCAUSE EFFECT
What actually happens
You did this

The user clicks the generate-comment button on a supported social-network page.

The extension did this

The extension reads post text, adds Instagram image CDN URLs when present, and sends those values to commenter.ai.

02EvidenceNETWORK CAPTURE
Captured request
POSTcommenter.ai (via stored api URL)
03EvidenceFIELD TABLE
Fields in the request
FieldValueWhy it matters
Post text from the page
Excited to announce our new product launch this week. (illustrative)This is the social-post content used to generate the suggested comment.
Instagram image CDN URL
https://scontent.cdninstagram.com/v/t51.29350-15/example.jpg (illustrative)This identifies an image attached to the Instagram post being processed.
04EvidencePLAIN NOTE
Observation

Dynamic analysis confirmed that the request includes postContent and urls fields when the generate-comment flow runs.

Updated 17 September 2026ffebfjkgjgbpmnoogjjdgfkmiobngdnf