Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward social content generator that uses OpenAI APIs and local output files as part of its stated purpose, with no evidence of hidden execution, persistence, or destructive behavior.
Install this as a draft-generation tool, not an autopublishing system. Do not put secrets, embargoed campaign plans, customer data, or confidential business details into topics or prompts unless you are comfortable sending them to OpenAI. Treat the optional upload/API credential documentation cautiously and require explicit review before any content is published to real social accounts.
The skill documents capabilities that involve writing files and making network/API calls, but it does not declare any explicit tool scope or permissions boundaries. This creates ambiguity for runtime enforcement and review, increasing the chance that the skill can perform broader actions than a user expects, especially when combined with optional upload functionality and credential use.
The description is broad enough to trigger on many ordinary requests related to marketing, captions, or social posts, which can cause over-activation of the skill. In a system with powerful capabilities, unnecessary invocation increases exposure to file/network actions and may lead to unintended content generation or publishing workflows being suggested.
The skill describes uploading posts through platform APIs and storing API credentials, but it does not prominently warn that content and metadata may be transmitted to third-party services or potentially published externally. Users may not realize that invoking upload functionality can move from draft generation to real external actions, creating privacy, reputational, and accidental-publication risk.
The script sends user-supplied topic text to OpenAI's external API for content generation without any explicit notice, consent, or privacy warning. In a social-content tool, users may enter sensitive campaign plans, embargoed product details, or customer-related data, causing unintended third-party disclosure if they assume processing is local.
The image generation path performs external network access, retrieves a remote URL, and writes the downloaded content to disk without explicitly warning the user that this will create files from third-party-generated content. This can surprise users in restricted environments and may introduce unsafe or policy-violating content onto disk if the remote response is unexpected or unverified.
No suspicious patterns detected.
