Security audit
Security checks for vulnerabilities and agentic risk
This Markdown publishing skill is purpose-aligned, but the reviewed package is incomplete and points users toward an unreviewed external script for a credentialed publishing workflow.
Review carefully before installing. Verify the actual bin/publish implementation from a trusted source, avoid running the external GitHub clone path unless you trust it, use dry-run first, check Markdown and embedded images for secrets or private data, and use least-privilege tokens for GitHub, Notion, and Medium.
This markdown file documents syncing/publishing markdown to Notion, GitHub Wiki, Medium, and exporting to local HTML, which can affect user data privacy and system state. The description lists capabilities but does not include any user warning that content will be transmitted to third-party services or written to local files.
The skill encourages publishing Markdown to third-party platforms and explicitly mentions automatic image uploads, but it does not warn users that content and embedded assets may be transmitted to external services. This can lead to accidental disclosure of sensitive text, metadata, or locally referenced images when users publish files they assume remain local.
The primary descriptive text is written in Chinese while the rest of the README includes English commands and labels, but there is no indication that the skill is intentionally region-specific or that users can choose their preferred language. This can constitute a language/locale policy issue when a skill imposes a language without opt-in or justification.
The manifest description and the rest of the skill instructions are presented only in Chinese, with no indication that users may choose another language or locale. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy violation.
No suspicious patterns detected.
