create-launch-post

Warn

Audited by Snyk on Oct 22, 2026

Risk Level: MEDIUM
Full Analysis

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

  • Direct money access detected (medium risk: 0.30). The documented workflow covers writing launch posts, rendering launch images, uploading a blog hero to AWS S3 / Cloudflare R2, opening a draft GitHub pull request, and scheduling social media posts via Buffer. The S3/R2 hero upload (SKILL.md:143-148) is a direct write/storage operation, but it is executed via the op run -- aws s3 cp command using standard AWS CLI credentials and access control. Scheduling social posts via Buffer (SKILL.md:248) uses the buffer_mcp integration with authenticated account/channel checks (get_account, list_channels, get_channel). Therefore, the skill includes direct operations protected by independent service-layer authentication and credential validation (AWS credentials via 1Password CLI op run and authenticated Buffer API/MCP session).

Issues (1)

W009
MEDIUM

Direct money access capability detected (payment gateways, crypto, banking).

Audit Metadata
Risk Level
MEDIUM
Analyzed
Oct 22, 2026, 03:37 AM
Issues
1