Security audit
Security checks for vulnerabilities and agentic risk
This skill has a coherent social-media digest purpose, but it handles connected account data and private comment identifiers with conflicting delivery instructions and weak user-control boundaries.
Review this skill before installing if your social accounts or customer/community data are sensitive. It should be tightened to use one delivery path, ask before scraping or using connected accounts, show file changes before saving handles or ideas, and avoid including third-party @usernames except where strictly necessary in a private local report.
The skill describes collecting comments from Instagram/TikTok, potentially via scraping or user-supplied screenshots, and then sending summarized results over Telegram/email without a clear privacy notice or data-handling boundary. Because this involves third-party content and identifiers, unclear consent and transmission practices materially raise privacy and compliance risk.
The skill instructs the agent to modify cerebro/f100k-config.json with new handles and elsewhere to append ideas to ideas/banco.md, but it does not require explicit user confirmation or a warning before changing local files. Silent persistence of personal account identifiers and content changes can violate user expectations and make unauthorized or hard-to-audit state changes.
The skill declares that in OpenClaw the Friday digest should go via Telegram and be saved to a local report, but later instructs creation of a Gmail draft. This inconsistency can cause data to be sent through an unintended channel, expanding exposure of scraped third-party comments and increasing the chance of privacy, compliance, and operational errors.
The template includes third-party @usernames and quoted comments in a drafted message, while earlier instructions say those identifiers are private and must never appear in public content. Even if the digest is intended for the account owner, this creates an unnecessary exposure and increases the risk of onward sharing, retention in email systems, or accidental reuse in public-facing outputs.
