Security audit
Security checks for vulnerabilities and agentic risk
This skill openly aims to publish daily AI opinion posts, but it relies on unattended scheduling and GitHub pushes that are not tightly scoped or review-gated in the artifact.
Install only if you intentionally want an unattended daily job that can generate, commit, and push public site content. Before enabling it, review the referenced source script, confirm it stages only the intended _posts file, use a dedicated Git branch or token with minimal permissions, and make launchd scheduling and automatic push explicitly opt-in.
The documented GitHub commit/push behavior exceeds the declared permissions of only http.request and file.write, indicating a mismatch between advertised capability and actual side effects. Hidden or undeclared publication behavior undermines permission transparency and could allow the skill to alter or publish repository content without users accurately understanding its access level.
The description presents the skill as a simple content generator but omits a clear warning that it writes into a repository and automatically commits and pushes changes on a daily schedule. In context, the daily unattended execution makes this more dangerous because it can repeatedly publish unwanted or manipulated content without timely human review.
The skill documentation states it will auto-commit and push to GitHub, which goes beyond the narrow user-facing purpose of generating a short opinion post. That creates an autonomous external side effect on a repository, increasing the risk of unintended content publication or repository changes without clear user awareness or necessity.
