Security audit
Security checks for vulnerabilities and agentic risk
This is a platform reference document for BulkPublish, with no executable code, install behavior, hidden persistence, or credential access.
This skill is safe to use as reference material, but users should still confirm visibility, destination channels, required titles, and media constraints before publishing because it can influence posts sent to public social platforms.
The description says 'ALWAYS consult before creating posts' but does not specify the exact situations, commands, or exclusions for when this skill should be invoked. That broad instruction could cause unintended invocation across many ordinary post-creation contexts without any negative examples or scope limits.
Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.
| `reel` | 1 video required | Vertical short-form video |
| `story` | 1 image OR 1 video required | Disappears after 24h |
**Media specs:** Image max 10MB (jpg/png/gif/webp). Video max 2GB (mp4/mov). Reel video 3–90s, Story video 3–60s; a plain video post has no length limit.
**platformSpecific options:**
- `linkPreview.url`
Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.
| `reel` | 1 video required | Vertical short-form video |
| `story` | 1 image OR 1 video required | Disappears after 24h |
**Media specs:** Image max 10MB (jpg/png/gif/webp). Video max 2GB (mp4/mov). Reel video 3–90s, Story video 3–60s; a plain video post has no length limit.
**platformSpecific options:**
- `linkPreview.url`
The file documents that omitted TikTok privacy publishes as 'PUBLIC_TO_EVERYONE', which can affect user privacy, but this safety-critical behavior is only described as a gotcha within platform options. The skill description does not present this as a prominent warning about privacy impact when using the skill.
Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.
| `post` (default) | 0-4 images OR 0-1 video | Text-only OK. No mixing. |
| `thread` | Per-part | Use `postFormat: "thread"` + `threadParts` |
**Media specs:** Image max 10MB auto-resized to <976KB (jpg/png/webp), max 4. Video mp4 only, max 1; no size limit is published for this upload path (~19MB is proven).
---
No suspicious patterns detected.