Security audit
Security checks for vulnerabilities and agentic risk
This skill coherently drafts blog posts from user-approved code and only writes files after explicit approval.
Before installing, understand that the skill can read blog posts or writing samples you provide, inspect the current workspace for blog conventions, and write an approved Markdown post. Review the draft for private details before approving any file save.
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
# Voice Profile
<!-- Saved by the make-blog-post skill. Edit anything that is wrong: your edits outrank what was inferred from the samples. -->
- **Author**: <name as it appears on posts; optional, used to filter multi-author sites>
- **Updated**: <YYYY-MM-DD>
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
| Eleventy | `.eleventy.js`, `eleventy.config.*` | `posts/`, or the folder named in the config | Front matter plus the directory data file. A `tags` value adds the post to a collection, which is usually what the feed and index read. |
| Next.js | `next.config.*` with an MDX or content pipeline | `content/`, `posts/`, `app/blog/`, or wherever the pipeline reads from | MDX rules apply: components must be imported or provided, and a raw `<` or `{` in prose breaks the parse. |
| Gatsby | `gatsby-config.*` | `content/blog/` | Front matter fields must exist in the GraphQL schema the templates query. The `path` given to `gatsby-source-filesystem` is the folder actually sourced. |
| Docusaurus | `docusaurus.config.*` | `blog/` | Date from the file name prefix or a `date` field. `<!-- truncate -->` marks where the excerpt ends in `.md`, and `{/* truncate */}` in `.mdx`. The blog plugin's `path` option moves the folder. |
| Hexo | `_config.yml` plus `hexo` in `package.json` | `source/_posts/` | YAML front matter. `<!-- more -->` marks the excerpt break. `source_dir` in `_config.yml` moves the source root. |
| Zola | `config.toml` with a `base_url` key, a spelling Hugo does not use | `content/` | TOML front matter fenced by `+++`, not `---`. The post belongs to a section, which is a subfolder of `content/` carrying its own `_index.md`. |
| VitePress | `.vitepress/` | The folder the theme configures | Front matter plus whatever index page lists the posts. |
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
### 5. Draft and get approval
Draft the post per **Building the post**, show it in full, and invite edits. Revise and show it again until the user approves. Silence or an ambiguous reply is not approval. Drafting and showing the post in the conversation needs no approval, but nothing is saved to a file, published, committed, or pushed before an explicit yes.
### 6. Deliver