Security audit
Security checks for vulnerabilities and agentic risk
The skill is a disclosed blog editorial scheduler that can write, schedule, and update local blog state files, with no evidence of hidden code, exfiltration, or unrelated privileges.
Install only if you want an agent to manage a blog publishing queue and potentially create drafts or scheduled CMS posts. Review `config.json`, CMS credentials used by the separate writer adapter, and prefer explicit `/blog-editorial-calendar` commands for publishing actions.
The trigger text includes a broad catch-all phrase ('or any variant of running a recurring publish cadence') for a skill that can autonomously write, schedule, and publish to a CMS. Overbroad invocation criteria increase the chance the agent will activate this skill on ambiguous user requests, leading to unintended file modifications or publication actions without sufficiently explicit user intent.
The skill description and usage guidance do not prominently warn that next always writes, may schedule or publish through a CMS adapter, and modifies local state files such as backlog.json and published-index.json. In this context, missing disclosure is safety-relevant because users may invoke status-like editorial actions without realizing the skill can trigger autonomous content creation and persistent changes.
No suspicious patterns detected.
