Security audit
Security checks for vulnerabilities and agentic risk
This skill helps plan content calendars and its bundled script is limited to generating local calendar output, with no evidence of hidden data access or persistence.
Before installing, expect the skill to help draft content plans and calendars. Only let it write an output file when you have chosen the destination, and review generated post copy before publishing it anywhere.
The skill instructs the agent to use scripts/build_calendar.py, which implies code/file-write capability, but the manifest does not declare any permissions or allowed-tools scope. That creates an authorization gap where the agent may invoke file-writing behavior without explicit scoping or user-visible constraint, increasing the chance of unintended filesystem side effects.
The trigger phrases are broad and map to common, everyday requests like 'post ideas' or 'what should I post', making accidental invocation more likely. Over-broad activation can cause this skill to preempt more appropriate skills or run in contexts the user did not intend, which is a routing and least-privilege problem rather than a direct exploit.
No suspicious patterns detected.
