Security audit
Security checks for vulnerabilities and agentic risk
This skill appears to be a straightforward blog helper that reads a markdown draft, generates image prompts, and saves an illustrated markdown version.
Install only if you are comfortable sending the selected blog markdown through the configured LLM/image-generation workflow. Keep outputDir dedicated to polished blog drafts, verify the selected input file before running, and avoid using directories that contain unrelated private markdown.
The description says the skill analyzes polished zh-CN blog markdown, and the usage section reinforces dependence on a blog-polish-zhcn workflow, but there is no user opt-in or explanation of why the locale restriction is required. Per policy, forcing a specific language or locale without choice or documented justification is a natural-language policy concern.
The manifest declares no required permissions, yet the workflow reads from and writes to local disk. This creates a trust and consent gap: an agent or user may treat the skill as low-privilege while it can still modify local markdown content and produce new files in the workspace.
Auto-discovering the latest .md file in a directory without declared permissions broadens the skill's effective access beyond a single user-specified file. If the directory contains unrelated or sensitive markdown documents, the skill may ingest the wrong file and process content the user did not intend to expose.
This step reads arbitrary local markdown content from a path-controlled input without corresponding declared permissions. In a skill ecosystem that relies on manifest permissions for user trust or sandboxing, undeclared file access can expose sensitive local content or enable unintended processing of files outside the expected workflow.
The user-facing description emphasizes image generation and placeholder embedding but does not prominently warn that the skill saves a modified markdown file on disk. This can lead to unintended file creation or confusion about persistence, especially in automated agent chains where users may not expect local content mutation.
No suspicious patterns detected.
