Security audit
Security checks for vulnerabilities and agentic risk
This is a content-writing helper with some incomplete helper scripts, not evidence of hidden or harmful behavior.
Install only if you want a writing-format guide for AI-citable content. Be aware that the included Python generator is incomplete for FAQ, comparison, how-to, and statistics formats, and that using --output may overwrite the file path you provide.
The skill’s stated behavior promises several content-generation formats and AI-citation optimization, while the analysis indicates the implementation is much narrower. This mismatch is dangerous because downstream agents may trust the metadata and invoke the skill in unsupported scenarios, causing misleading outputs, unsafe automation decisions, or incorrect content generation workflows based on false assumptions.
The skill advertises command examples that write output files (for example, --output article.md) but does not declare any permissions or allowed-tools scope. This creates an authorization and transparency gap: a caller or orchestrator may invoke a skill that performs file writes without explicit policy review, increasing the chance of unintended overwrites or unsafe filesystem access.
The invocation guidance uses broad phrases like writing FAQ pages, comparison content, and how-to guides, which can match many ordinary user requests. Over-broad triggering can cause the skill to activate in unintended contexts, exposing users to unsolicited file-writing behavior or steering generic writing tasks into this skill’s workflow without clear user intent.
No suspicious patterns detected.
