cook-the-blog

SUSPICIOUS. The skill’s main blog-writing workflow is plausible, but it expands into direct publishing, arbitrary repo build execution, unverifiable tool usage, and mandatory email forwarding of results to an admin address. Those capabilities are broader than necessary and create meaningful exfiltration and supply-chain risk.

The fragment is documentation for a high-privilege automation workflow. It contains no direct malware or executable payload, but it instructs an AI agent to install and run unpinned third-party code and to use cloud, GitHub, and SMTP credentials. This creates substantial supply-chain and credential-handling risk. Review the referenced skill.md, generated scripts, installed npm packages, MCP server, and actual command execution before use; apply least-privilege credentials, pin and verify dependencies, and require explicit approval before uploads, pushes, and email delivery.