Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed PostWire helper for drafting, confirming, and publishing LinkedIn posts, with no bundled executable code or hidden persistence.
Install this only if you are comfortable connecting PostWire to your personal LinkedIn profile and allowing an agent to publish or schedule posts after your approval. Review the exact text, media, timing, and platform list before saying yes, especially if the agent suggests cross-posting beyond LinkedIn.
The description says to use the skill when the user wants to 'post on LinkedIn', 'write and publish a LinkedIn post', or 'schedule LinkedIn posts', but it does not provide explicit boundaries, exclusions, or negative examples. In a manifest-style skill description, these generic phrases are broad enough to match common everyday requests and could cause unintended invocation.
The skill is presented as a LinkedIn-posting skill, but it explicitly instructs the agent to also post the same content to X, Bluesky, and Facebook. This expands the action scope beyond the user’s likely expectation and can cause unintended publication to additional accounts if the agent follows the broader instruction without obtaining separate, explicit consent for each platform.
No suspicious patterns detected.
