Security audit
Security checks for vulnerabilities and agentic risk
This is a simple poster-generation skill whose text-processing and optional URL-fetching behavior is disclosed and aligned with its stated purpose.
Install only if you want an agent to process pasted text or user-provided article URLs into poster content. Do not paste private or sensitive material unless you intend it to be summarized into a poster, and use URL mode only for public pages you trust.
The description says users can generate posters by simply pasting content, which encourages implicit automatic activation from arbitrary text. In an agent environment, this increases the risk that unrelated or sensitive pasted material is consumed by the skill without a clear consent boundary.
The invocation examples are broad enough that ordinary user messages like pasted text or a casual request to 'make a poster' could trigger the skill without clear user intent boundaries. This can cause unintended processing of sensitive content and may activate downstream behaviors such as content transformation or URL handling when the user did not explicitly request the skill.
The skill explicitly supports fetching content from user-provided URLs but does not disclose network access, trust boundaries, or safety checks. This can expose the agent to server-side request risks, retrieval of untrusted remote content, and accidental access to internal or sensitive endpoints if URL fetching is implemented naively.
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
permit persons to whom the Software is furnished to do so.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE
FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER