Security audit
Security checks for vulnerabilities and agentic risk
ClawScan marks this skill benign because the reported findings are low probability and considered expected for its purpose, though the overall confidence is medium and the scan was partial.
The verdict is benign, not risk-free. Consider whether English-only polishing and an unpinned `npx astro` reference suit your needs. The scan was partial: some local references could not be resolved, so the evidence does not cover all referenced context.
The instruction to fix grammar, spelling, and clarity "in English" imposes a language requirement without asking the user. The skill also handles Chinese history and literature articles, but does not justify an English-only constraint or explicitly preserve the source language.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
quote any frontmatter value containing YAML-special characters — especially `: ` (colon + space).** An unquoted `description: Foo: bar` is parsed as a mapping and fails the build at content sync (`bad indentation of a mapping entry` / `mapping values are not allowed in this context`); Cloudflare then keeps the **previous** deployment, so the post never appears and search can't find it. Wrap the whole value in double quotes: `description: "Foo: bar"`. Applies to every field (`title`, `description`, …). This has recurred several times.
10. **Write the post** to `src/data/blog/<category>/<filename>` with the frontmatter followed by the polished body.
11. **Report** `postPath` and `imagesCopied` to the user.
12. **Commit & push (only after approval):** ask the user explicitly whether to commit. On approval, stage the post and any new images in `astro_journal`, commit with a concise message, and push to `origin`. Without approval, leave the changes uncommitted and say so.
## Verification
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.