social-content

The skill consists solely of markdown files (SKILL.md, references/platforms.md, references/post-templates.md, references/reverse-engineering.md). No executable code, scripts, or external dependencies (like npm install or pip install) are present or instructed to be run by the AI agent. All references within the skill are to other local markdown files.

No patterns indicative of direct prompt injection, data exfiltration, obfuscation, privilege escalation, persistence mechanisms, or time-delayed attacks were found within the skill's instructions or metadata.

The skill does instruct the AI to read a local file: "If .claude/product-marketing-context.md exists, read it before asking questions." While this is a local file reference and not an external download, it introduces a potential vector for indirect prompt injection. If the content of .claude/product-marketing-context.md were to be controlled by an attacker or contain malicious instructions, the AI could be influenced. This is an informational warning about susceptibility, not a direct threat originating from the skill's own code.

References to external tools like Apify and Phantom Buster in references/reverse-engineering.md are descriptive and part of a human-readable guide; they do not instruct the AI to execute or download anything from these services. Therefore, they do not constitute an 'Unverifiable Dependency' for the AI agent itself.

Given the absence of any executable code and direct malicious patterns, the skill is deemed SAFE, with the caveat regarding indirect prompt injection susceptibility from external content it is instructed to process.