Security audit
Security checks for vulnerabilities and agentic risk
This skill only provides drafting guidance for turning user-supplied content into social media posts, with no code execution, persistence, credential access, or automatic publishing.
Before using this skill, make sure the source material is yours or authorized for public reuse, and avoid providing confidential, unpublished, regulated, or third-party content unless it is safe to turn into social media drafts.
The skill is designed to turn source material into public-facing social posts but never warns about confidentiality, copyright, consent, or unpublished material. That omission makes it easier for users or upstream automation to repurpose private, proprietary, or third-party content into public outputs, creating privacy, legal, and reputational exposure.
The manifest includes vague trigger phrases like everyday commands that lack boundaries around source content, destination platform, or user intent. In an agent environment, this creates overbroad matching that may hijack unrelated conversations or activate on sensitive text, causing accidental processing or disclosure of content.
The activation conditions are broad enough to match common user requests like 'repurpose this' or generic social-media adaptation prompts without strong scoping. That can cause unintended skill invocation and lead the agent to transform content the user did not clearly intend to publish or adapt, increasing the chance of privacy leaks, misrouting, or unsafe automation.
The example text includes the Chinese word "平凡," and a later section title uses "反驳," while the rest of the skill is written in English and does not state that multilingual output is optional. This can conflict with language consistency expectations because the skill implicitly introduces another language without user opt-in or explanation.
No suspicious patterns detected.
