Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward SEO metadata helper that reads one blog post, researches current phrasing, and saves a JSON metadata file in a disclosed folder.
Before installing, be aware that the skill will read blog drafts from ~/blogs, browse public sites for SEO research, and save generated metadata under ~/blog-meta. Review the output path if you already keep files there, since the instructions do not explicitly say to ask before overwriting an existing JSON file.
The instruction 'Use this file whenever drafting a comment, reply, or post' is extremely broad and overlaps with common, everyday writing tasks. It does not define scope, context, exclusions, or negative examples, so the trigger boundary for when this skill should or should not apply is unclear.
The directive 'Ban them unconditionally' imposes a mandatory stylistic and lexical policy on generated writing rather than offering user choice. Because the document positions this as baseline behavior for drafting replies and posts, it can force a particular language style without explicit user opt-in.
The skill directs the agent to create a directory and write a JSON file under ~/blog-meta/ without any explicit user confirmation or warning about filesystem modification. While this is aligned with the skill’s stated purpose, unattended writes to the user’s home directory can still cause unwanted file creation, overwrites, or persistence of generated content if the invoked filename is not carefully controlled.
The skill explicitly instructs the agent to write a JSON file into the user's home directory (~/blog-meta/...) without any stated user confirmation or safety boundary. While this appears to be normal workflow for the skill, silent local file modification can still be risky because an agent may overwrite existing files or create artifacts the user did not explicitly approve.
No suspicious patterns detected.
