Security audit

PostKing · Blog

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed PostKing blog-management guide, but users should be careful because it includes publishing and deletion workflows.

Install this only if you intend to let the agent manage PostKing blog content. Before any delete, hosted publish, scheduled publish, or push to WordPress/Medium/Substack, require the agent to restate the target article or publication and destination and get your explicit approval.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill documents destructive and externally publishing actions (`delete_blog_article`, `delete_publication`, `update_blog_article({ status: "published" })`, and `publish_blog_article`) without requiring an explicit confirmation or warning step before those actions are taken. In an agent setting, this increases the chance of accidental publication or deletion from ambiguous user prompts, causing unintended data loss or public release of draft content across hosted or third-party platforms.

Static analysis

No suspicious patterns detected.