Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed PostKing landing-page management skill, with live publishing and domain actions that users should treat carefully but no evidence of hidden or malicious behavior.
Install this only if you want the agent to manage PostKing landing pages. Before allowing publish, unpublish, delete, rename, restore, or domain-removal actions, confirm the exact page, side page, version, or domain and review the preview or current state first.
The skill documents publish_landing_page and deletion-capable lifecycle actions as routine steps without a consistent requirement to confirm destructive or externally visible changes with the user first. In an agent setting, that can lead to unintended publication of draft content or irreversible content removal when the model interprets an editing request too broadly.
The custom-domain section notes that delete_domain removes a domain and that connected pages are unlinked, but it does not present this as a prominent safety warning or require confirmation before suggesting the action. In practice, an agent could remove a live domain during cleanup or troubleshooting, causing immediate loss of intended public routing for live landing pages.
No suspicious patterns detected.
