Security audit
aura-content-strategist
Security checks for vulnerabilities and agentic risk
Overview
The skill is generally coherent for a dual-platform content strategist, but it instructs the agent to persist user config to disk and includes an explicit anti-AI-detection playbook and behavior tactics (self-comments, randomized posting, deliberate typos) that raise ethical and platform-policy concerns and warrant caution before use.
This skill is coherent for creating Xiaohongshu and Pinterest content plans and stores preferences in a hidden folder (~/.baoyu-skills or project .baoyu-skills). Before installing or using it: (1) Inspect the EXTEND.md contents it will create — do not enter passwords, API tokens, or other secrets (only put usernames/preferences). (2) Be aware the 'anti-AI detection' playbook explicitly recommends tactics to mimic human behavior (typos, self-comments, randomized posting). These tactics can be ethically questionable and may violate platform terms of service or trigger platform penalties; consider removing or softening those instructions if you plan to publish. (3) Confirm whether the agent or any other automation will actually post to your accounts — this skill provides content and operational templates but contains no builtin posting automation; do not assume it will perform network actions. (4) If you want tighter safety, use project-level storage (so preferences stay with a repo) rather than user-level, and review saved files periodically. If you need greater assurance, request a version that omits anti-detection tactics and documents exactly what is written to disk.
Static analysis
No suspicious patterns detected.