Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed weekly AI roundup publisher, but it automatically schedules, writes, commits, and pushes to GitHub with under-scoped permissions and limited user control.
Review before installing. This skill appears intended for a specific publisher workflow, but it should only be used if you are comfortable with it reading a local API key, modifying the named Jekyll repository, running on a schedule, and pushing generated content to GitHub without a separate human review step.
The documented behavior includes auto-committing and pushing to GitHub, but the declared permissions only list http.request and file.write. This permission/behavior mismatch undermines security review and sandbox assumptions, because the skill appears less capable than it really is and may rely on undeclared ambient credentials or external tooling to publish changes.
The skill creates a persistent file in the Jekyll _posts directory and then auto-commits/pushes it, so its output survives the session and propagates beyond the local machine. In this context, persistence is more dangerous because the content is generated from external sources and an LLM, making accidental misinformation, prompt-influenced content, or unsafe text durable and publicly published.
- Fetches top 60 HN stories from the past 7 days
- Filters for AI/ML keywords and sorts by engagement
- Uses MiniMax to pick the 5 most significant and write contextual commentary
- Creates a Jekyll post in `_posts/YYYY-MM-DD-ai-weekly-roundup.md`
- Auto-commits and pushes to GitHub
The skill description does not clearly warn that it writes into a local site repository and auto-pushes changes to GitHub. In context, this is dangerous because the skill is scheduled to run automatically, so hidden persistence and publication behavior can repeatedly modify a live content repository without the operator fully understanding that side effect.
The skill documentation states it will auto-commit and push to GitHub, but that materially sensitive behavior is omitted from the manifest description. This creates a transparency and consent problem: a user or orchestrator may approve a content-generation skill without realizing it also publishes changes remotely, increasing the risk of unintended repository modification or data release.
Automatic GitHub push is more privileged than the stated purpose of curating and drafting a weekly roundup. Even if intended for convenience, bundling content generation with publication expands the blast radius: bad inputs, prompt manipulation, or simple mistakes can directly alter a live site without human review.