Security audit
Security checks for vulnerabilities and agentic risk
This social-media automation skill is coherent, but it can schedule unattended public posts and auto-replies using account credentials without enough safeguards or clear permission boundaries.
Review this carefully before installing. Only use it with accounts where automated posting is acceptable, store credentials with restrictive permissions, test with non-public or low-risk content first, and avoid enabling cron or auto-replies until you have a clear way to preview, log, pause, and remove scheduled actions.
The README tells users to configure platform credentials but provides no guidance on secure secret handling, storage location hardening, rotation, or exclusion from logs/version control. In a skill that automates posting to public platforms, exposed credentials could let an attacker take over social accounts, publish content, or access linked platform data.
The README encourages scheduled automated posting via cron without warning that this performs unattended actions against external services. If tasks are misconfigured, compromised, or left running unexpectedly, the skill could continuously publish unwanted content or violate account/platform policies without immediate user awareness.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
crontab -e
# 添加 crontab-example.txt 中的内容
The skill advertises capabilities that imply reading/writing files and making networked posts, but it declares no explicit tool scope or permission boundaries. In an automation skill that can publish to external accounts and use local configuration secrets, this creates a meaningful risk of over-broad access, unintended actions, and misuse of credentials without clear user consent or runtime restriction.
The skill enables automated posting and comment auto-replies to public external platforms, but the description does not warn users about account-impacting actions, public visibility, scheduling risk, or automated engagement behavior. In this context, omissions are dangerous because users may trigger irreversible posts, spam-like behavior, or reputation-damaging replies without understanding the consequences.
The skill name and description are presented as a Chinese-language social media assistant, including China-specific platforms, but there is no indication that language/locale is optional or user-selectable. This can violate language/locale policy when a skill appears to prescribe a specific language experience without opt-in.
The description "社交媒体自动化运营助手" (social media automation operations assistant) is a broad capability statement rather than a specific activation scope. In a manifest file, this can create ambiguous triggering because it does not define clear boundaries, explicit trigger phrases, or exclusion conditions for when the skill should or should not run.
The script persists scheduled post content, platform, images, and timestamps to a plaintext file under the user's home directory without any notice, minimization, or protection. In a social-media automation skill, this can expose sensitive or unpublished campaign content to other local users, malware, backups, or accidental disclosure, especially because drafts may contain embargoed messaging or credentials-adjacent metadata.
The run path automatically publishes all due tasks with no interactive confirmation, dry-run mode, or final review step. In the context of a tool that posts to public social platforms, this increases the risk of unintended or maliciously queued content being published automatically, causing reputational harm, policy violations, or disclosure of sensitive information.
The file's natural-language comments are written only in Chinese, which imposes a specific language/locale on users without any opt-in or indication that the skill is region-specific. This matches the policy-violation category for language or locale constraints expressed in natural language.
The manifest description is written only in Chinese, which may imply a fixed language experience for users without any stated opt-in, fallback, or region-specific justification. Because language/locale policy violations can appear in config or manifest text, this is a potential issue if the skill is intended for general use.
No suspicious patterns detected.