Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Web3 community marketing playbook with no executable code, hidden agent directives, persistence, or credential handling.
Installers should treat this as advisory marketing guidance, not an automation tool. Review any suggested public posts, DMs, bot workflows, analytics tools, or token-gating steps before applying them to real communities or accounts.
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
</linearGradient>
</defs>
<!-- Background -->
<rect width="1280" height="400" fill="url(#bg)"/>
<!-- Glow blob -->
The trigger description is overly broad and includes a catch-all clause that can cause the skill to activate for loosely related blockchain, DeFi, NFT, or DAO community questions. Over-broad routing increases the chance of misclassification, unnecessary invocation, and unintended influence over unrelated user requests, especially in autonomous agent settings where skill selection affects downstream behavior.
The trigger examples include a Spanish phrase alongside English-only guidance, but the file does not state that responses should preserve the user's language or offer locale choice. This can create an implicit language-handling policy inconsistency rather than an explicit opt-in multilingual behavior.
No suspicious patterns detected.