Security audit
Security checks for vulnerabilities and agentic risk
This skill clearly discloses X automation, but it can use a logged-in browser session to publish AI-generated public posts without a final user approval step.
Install only if you are comfortable with an agent using your active X browser session to research trends, generate opinionated posts, and publish them. Before using it, require the agent to show the final draft, account, and destination, and get explicit confirmation before posting.
The workflow directs the agent to compose and publish a tweet automatically, but does not require an explicit confirmation step immediately before posting. Because posting to X is an external side effect with reputational and operational consequences, automatic publication of AI-generated, intentionally opinionated content can lead to accidental, harmful, or unauthorized public statements.
The activation text is broad enough to trigger on generic requests like posting to X or checking trends, without strong guardrails on scope, consent, or review. In a skill that can generate and publish public content, over-broad invocation increases the chance the agent performs unintended social-media actions or gathers external context when the user did not clearly authorize the full workflow.
No suspicious patterns detected.
