blog-writer
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The skill's instructions require automatic publishing to a Notion database and saving to a local references folder, but the package does not declare any Notion credentials or matching file paths—these mismatches make the workflow incoherent and need clarification before install.
Before installing, ask the skill author or maintainer to clarify two things: (1) How does the skill authenticate to Notion? It currently mandates publishing to a Notion DB but lists no required env var (e.g., NOTION_TOKEN) or OAuth flow—do you expect the platform to provide credentials, or will the skill prompt for a token? Don't hand over Notion credentials until you understand this. (2) Confirm file path layout: SKILL.md references references/blog-examples/ and references/style-guide.md but the package files appear at the repo root—verify the agent will read/write the intended locations. Also note the skill requires publishing every draft to Notion (even unfinished drafts); if you want drafts kept private, clarify or modify the workflow. Finally, if you permit pruning, ensure pruning is done interactively (the provided script requires --execute to actually delete) and test in a sandbox before allowing automatic runs that modify or delete files.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
No VirusTotal findings
Risk analysis
No visible risk-analysis findings were reported for this release.