Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent Typecho blog publishing helper, but it uses stored credentials to publish or edit live posts without explicit confirmation safeguards.
Review this before installing if the blog has real readers or business impact. Only configure credentials you are comfortable letting the agent use, and require an explicit confirmation step before login, publishing, or saving edits.
The skill description includes broad scenarios such as helping write and publish or edit existing posts, which can match ordinary content-assistance requests and trigger a high-impact action skill too easily. Because this skill can authenticate and modify a live blog, ambiguous activation increases the chance of unintended publication or edits without sufficiently explicit user intent.
The skill is designed to use stored blog credentials to log in and publish or edit content, but it does not require an explicit warning or confirmation before performing authenticated, state-changing actions. This creates a meaningful risk of unauthorized or accidental publication, modification of existing content, and misuse of privileged access if the skill is invoked under ambiguous circumstances.
