Security audit
Security checks for vulnerabilities and agentic risk
This skill is coherent for blog publishing, but it can immediately send drafts to external services and publish them publicly without a built-in confirmation or draft-only safeguard.
Install only if you want an agent to help publish to these specific platforms. Before using it, require the agent to show the exact title, body, tags, canonical URL, target account, and platform, and confirm whether it should create a draft or publish live.
The skill description is broad enough that an agent could invoke it for generic 'publish' or 'blog post' requests without clearly confirming the target platforms, workflow, or that the user intends live posting. Because this skill performs real publication actions, over-broad triggering increases the chance of unintended external posting rather than just local formatting assistance.
The skill instructs immediate submission of article content to third-party platforms using available credentials, but does not require an explicit warning that content will be transmitted externally and may be published live. In an agent setting, this can cause accidental disclosure of unpublished, sensitive, or incorrect content and trigger irreversible public actions.
This command sends article content and metadata to an external API using authenticated credentials, which is a true external transmission path. In context, external posting is the purpose of the skill, but it remains dangerous because an agent could exfiltrate sensitive draft content or publish unintentionally if the action is triggered without explicit approval.
curl -X POST https://dev.to/api/articles \
-H "api-key: $DEVTO_API_KEY" \
-H "Content-Type: application/json" \
-d '{
No suspicious patterns detected.