Security audit
Security checks for vulnerabilities and agentic risk
The skill is an automated blog-post publisher that discloses GitHub publication, but it also schedules and pushes generated content without a clear human approval step.
Install only if you intend this skill to use a MiniMax key, create Jekyll posts in the named repository, run on a Friday schedule, and push commits to GitHub. Treat it as an automated publisher, not just a drafting helper, and add a human review or draft-only step before using it on a live site.
The skill documents GitHub push behavior even though declared permissions only list http.request and file.write. This is dangerous because the effective capability surface is broader than the declared permission model, undermining trust and making it harder to enforce or audit repository-modifying actions.
The manifest description presents the skill as a simple weekly mini-review, but the body documents additional impactful behavior: creating posts, auto-committing, and pushing to GitHub. This mismatch reduces informed consent and can cause users or reviewers to underestimate the operational and publication risk of enabling the skill.
The skill performs network retrieval, writes a Jekyll post, and auto-pushes changes, but it does not prominently warn users about data transfer, local file modification, or remote publication impact. Lack of explicit warning increases the chance of accidental execution in sensitive repos or environments where external content and autonomous publishing are risky.
The skill creates persistent artifacts by writing posts to the repository and then committing and pushing them, which extends generated content beyond the current session. In context, persistence is an intended feature, but without explicit approval and scope controls it can turn transient model output or fetched community content into durable published state.
- Picks a tool from 8 Sol-uses rotation (Claude Code, OpenClaw, MiniMax, Cursor, Warp, dev.to API, HN API, GitHub Actions)
- Fetches relevant dev.to discussion for context
- Uses MiniMax to write a 350-500 word mini-review in Sol's voice
- Creates a Jekyll post in `_posts/YYYY-MM-DD-tool-spotlight-TOOL.md`
- Auto-commits and pushes to GitHub
Auto-commit and push behavior materially expands the skill from content drafting into autonomous publication, which is not necessary for merely generating a review. That creates a pathway for unintended or low-quality content to be published to a live repository without an explicit approval checkpoint.
The schedule is specified as 'Fridays at 9am UK time,' which imposes a specific locale/timezone in natural language. The file does not offer user opt-in or explain why the UK locale is required, so this may violate language/locale policy guidance.