Security audit
Security checks for vulnerabilities and agentic risk
This skill openly targets dev.to growth automation, but it includes automated public publishing and a daily schedule without clear approval controls or safe secret handling.
Review carefully before installing. Only use this with a dedicated dev.to API key, confirm what account it can post to, require preview and explicit approval before each publish, and avoid any setup that embeds API keys in source code or creates an automatic launchd schedule without clear disable steps.
The skill metadata describes a broad 'viral engine' for mining, advertising, and cross-posting content without clear invocation boundaries or user-approval gates. In an agent ecosystem, vague scope increases the chance the skill is selected for general content-growth requests and performs networked promotional or publishing actions the user did not explicitly intend.
The skill explicitly includes a cross-post capability that publishes to dev.to via API, but the description does not prominently warn that it can perform external publication. Because the skill has HTTP posting permissions and is scheduled to run daily, this omission raises the risk of unintended public posting, spam-like behavior, or reputational damage if the agent uses it without informed user consent.
The setup instructions disclose credential locations and state that the dev.to API key is embedded in the script, without any safety guidance. Embedding API keys in code and documenting secret paths can normalize insecure secret handling, increasing the chance of credential leakage, accidental commits, unauthorized publishing, or abuse of connected accounts.
No suspicious patterns detected.
