My goal is to support the community and continue creating more useful tools. If these automations prove to be very helpful to you, or if you see value in what I'm sharing, any donation, no matter how small, is welcome and will allow me to dedicate more time and resources to building new templates and contributing more solutions. https://donate.stripe.com/bJe6oGaaQ9JC1jf15gdwc01 Thank you for your interest, and I hope you find them very useful.

• Outcome: Review
• Latest audit: Jul 10, 2026 · 3:45 AM UTC
• Version: 0.1.0

Overview

This is mostly a social media content guide, but it needs review because it claims publishing access and encourages large-scale scraping without clear safeguards.

Review this skill before installing. Use it draft-first, manually approve every post or scheduled item, confirm the destination account and platform, and only use lawful, platform-approved exports or APIs for content research. There is no evidence of malware or hidden local persistence, but the publishing and scraping guidance is too under-specified to treat as fully benign.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The skill explicitly recommends large-scale collection of third-party social posts using scraping and automation tools that are not necessary for the core function of drafting and scheduling content. In an agent context, this can normalize bulk data harvesting from external platforms, potentially violating platform terms, privacy expectations, or causing the agent to perform collection beyond user intent.

Vague Triggers

Medium

• Confidence: 74% confidence
• Finding: The activation criteria are broad enough to trigger on generic mentions of social media, engagement, or viral content, which can cause the skill to activate outside a narrowly bounded task. Over-broad invocation increases the chance that higher-risk capabilities in the skill, including publishing guidance and scraping recommendations, are introduced in contexts where the user did not ask for them.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The skill claims direct access to a scheduling platform that publishes to major social networks, but it does not require clear disclosure, consent, or confirmation before external posting actions. In an agent environment, this creates a real risk of unintended publication, reputational harm, or posting to the wrong account/platform without the user understanding that real-world actions may occur.

Unrestricted Tool Access

Medium

• Category: Excessive Agency

Content

Gather 500-1000+ posts from your identified creators for analysis:

**Tools:**
- **Apify** — LinkedIn scraper, Twitter scraper actors
- **Phantom Buster** — Multi-platform automation
- **Export tools** — Platform-specific export features

• Confidence: 84% confidence
• Finding: Tools:*

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.