Security audit
Security checks for vulnerabilities and agentic risk
This is a simple blog-planning prompt skill with no executable code, but it includes visible payment promotion that users should notice before installing.
Install only if you are comfortable with a skill that embeds a visible paid upgrade pitch and payment links inside its instructions. From the inspected files, it does not run code, persist changes, or access private data.
The activation examples use broad natural-language requests that closely resemble ordinary user prompts, which can cause accidental or over-broad skill invocation when a user is asking for generic content help. In agent ecosystems, ambiguous triggering increases the chance that unreviewed skill behavior, promotional content, or external links are surfaced without clear user intent.
The manifest describes a content-planning skill for generating blog strategy artifacts, but these lines add commercial upsell and payment instructions, including a PayPal link and crypto wallet address. Selling or collecting payment information is not a direct or obvious requirement of planning blog content.
The manifest positions the skill as a planner for blog content calendars, topic clusters, and editorial workflows. The claim about providing 'production-ready templates, Python scripts, and real examples' expands the described behavior into code/script generation, which is not reflected in the planning-oriented manifest description.
No suspicious patterns detected.
