Security audit
Security checks for vulnerabilities and agentic risk
This social media helper is a disclosed content, hashtag, and calendar generator with no evidence of hidden access, persistence, or credential use.
Install only if you want local assistance drafting social media content and planning schedules. Review generated posts before publishing, and be careful with --output paths because generated JSON files may overwrite an existing destination.
Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.
## Notes
- Always comply with platform terms of service
- Maintain consistent brand identity
- Engage with comments and messages promptly
- Track competitors and industry trends
The document is otherwise written in English, but line L095 includes Chinese text ("专属") inline without offering a language choice or explaining a locale-specific purpose. This creates a natural-language locale inconsistency that may violate organizational language policy for skills expected to operate in a single language unless users opt in.
This code writes generated content to a user-specified file path, but there is no warning, confirmation, or comment indicating that an existing file may be overwritten. Although the operation is not highly sensitive, SQP-2 applies to file writes in code when there is no disclosure at all.
No suspicious patterns detected.