Phy Devto Post
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The skill's requests and runtime instructions match its stated purpose (posting to DEV.to by controlling Chrome on macOS); it does not ask for unrelated credentials or install components, but it requires enabling Apple Events and controlling your browser session which has obvious privacy implications.
This skill is coherent with its stated purpose but exercises sensitive browser control on macOS. Before installing or using it: (1) only enable Chrome's "Allow JavaScript from Apple Events" if you trust the skill; (2) run it with the DEV.to account you intend to publish from (consider a separate profile or test account); (3) review the SKILL.md to confirm the JS being injected matches what you expect; (4) be aware the skill will run JS in your active tab and may read session-scoped data (cookies/CSRF token) and write temporary files under /tmp; (5) if anything looks unexpected during a run (unexpected page navigation or titles), stop and sign out/revoke sessions on DEV.to. If you are not comfortable granting control of your browser session, do not install or use this skill.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
No VirusTotal findings for this skill version.
Risk analysis
No visible risk-analysis findings were reported for this release.