Security audit
Security checks for vulnerabilities and agentic risk
The skill is mostly coherent for preparing social-media publishing packs, but it includes real publishing paths with public and cross-posting defaults that need explicit user review before installation.
Install only if you are comfortable with a social publishing skill that can prepare payloads for real posting. Keep it in mock or dry-run mode until you have confirmed account scopes, platform choices, privacy settings, and cross-posting behavior; require explicit approval before any public publish.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
## Safety & secrets
- Never commit API tokens to the repo
- Use environment variables / .env
- Start with PUBLISH_MODE=mock or dry_run
The instruction 'For CN platforms: avoid long exposition; favor short rhythm and hooks' imposes a locale-specific writing policy, and later platform rules require CN hashtags and CN/EN title handling. The file does not present this as an optional user choice or clearly justified regional compliance constraint, so it can violate language/locale policy expectations.
The TikTok template hard-codes the publishing privacy option to "public", which can cause unintended broad distribution if downstream publishers treat the template as authoritative. In a distribution/publisher skill, defaults strongly influence real posting behavior, so failing to require explicit user choice or a safer default materially increases the risk of accidental public disclosure.
The Douyin template also defaults privacy to "public", creating the same accidental-exposure risk for a platform-specific publisher. Because this skill is expressly designed to route content toward real publishers, a public-by-default setting is more dangerous than in a purely illustrative schema file and can directly contribute to unintended publication.
The lang field is restricted to zh|en, which is a natural-language locale constraint. The file does not explain that this is optional, user-selectable, or justified by a documented regional scope, so it may violate language-choice policy expectations.