Security audit
Security checks for vulnerabilities and agentic risk
This skill is openly meant to automate social media posting, but it does not define approval, privacy, or rollback controls for public posts made through connected accounts.
Install only if you are comfortable connecting AI and social-posting credentials. Treat this as a Review item: use draft-only workflows or manual review until the publisher documents per-post confirmation, account scope, rate limits, audit logs, deletion or rollback steps, and third-party data handling.
The listing explicitly promotes 'full content automation' and 'multi-platform posting' but provides no warning, guardrails, or mention of approval controls for actions that can publish externally at scale. In an agent-skill context, this increases the risk of unintended, abusive, or policy-violating posts being generated and sent across multiple accounts without adequate human review.
The skill explicitly automates discovery, generation, scheduling, and publishing to social platforms, but it does not clearly warn users that running it can cause autonomous outbound posting. That creates a real safety and trust issue because users may grant credentials or invoke the tool without understanding that it can perform public actions on their behalf.
The manifest description is overly broad and frames the skill as an automated system for discovering topics and publishing to social media, but it does not define clear invocation boundaries, approval requirements, or operational limits. In an agent setting, this ambiguity can cause the skill to be selected in inappropriate contexts and enables unintended autonomous posting or external data handling without sufficiently specific user intent.
The manifest advertises automated multi-platform publishing and AI-powered research/scheduling, yet it provides no user-facing warning that content may be transmitted to external APIs and posted publicly on connected social media accounts. This is dangerous because users or calling agents may trigger irreversible external actions, causing privacy leaks, reputational harm, or unauthorized publication if approval and disclosure are not made explicit.
The documentation instructs users to provide API keys and describes use of external AI providers and social/trend sources, but it does not warn that prompts, content, metadata, and possibly account-linked data may be transmitted to third-party services. This can mislead users about privacy expectations and data handling, especially when external content sources and posting platforms are involved.
No suspicious patterns detected.
