Security audit
Security checks for vulnerabilities and agentic risk
This is a markdown-only writing skill for creating social-media hooks, with no executable code or hidden high-impact behavior found.
Installers should expect this skill to read brand and voice guidance files when available and to activate on broad hook-writing requests. It appears suitable for low-risk copywriting use; review generated hooks for truthfulness and brand/compliance fit before publishing.
The trigger phrases are broad and include common natural-language requests such as "hook for this," "opening line," and "make this scroll-stopping," which could cause the skill to activate unintentionally in ordinary conversation. Misrouting user intent to this skill can lead to incorrect task execution, bypassing more appropriate skills or workflows and degrading reliability.
This is a JSON manifest/evals file, so vague-trigger checks apply. The example input "Give me a few hook options for this post." is broad everyday phrasing and does not define any activation constraint, which could encourage unintended invocation if used as a trigger pattern.
Inputs such as "Write a hook for our launch.", "Write me a scroll-stopping hook.", and similar generic requests are common conversational phrasing rather than narrowly scoped activation language. In a manifest-like test file, the lack of explicit trigger constraints or negative examples makes it unclear when the skill should activate versus when a general writing assistant should respond.
Lines L04-L05 prescribe a specific writing voice ('blunt indie-founder voice') and require outputs to use the loaded voice.md. This is a natural-language policy concern because it forces a stylistic/locale-related constraint on output without indicating user selection or opt-in.
No suspicious patterns detected.
