Skills viral-verification
๐Ÿ“ฆ

viral-verification

Content revision r1 High Risk โš™๏ธ External commands๐Ÿ“ Filesystem access๐Ÿ”‘ Env variables

Validate Viral Social Posts

Draft posts often fail because weak hooks, pacing, or value are hard to see. This skill scores those factors and suggests sharper rewrites.

Supports: Claude Codex Code(CC)
โš ๏ธ 38 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "viral-verification" from https://skillstore.io/skills/wangdefou-dev-viral-verification.md and its manifest at https://skillstore.io/api/skills/wangdefou-dev-viral-verification/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/wangdefou-dev-viral-verification.md Signed manifest GET /api/skills/wangdefou-dev-viral-verification/manifest Signed lockfile GET /api/skills/wangdefou-dev-viral-verification/lockfile

Test it

Using "viral-verification". A short product launch post about a new analytics dashboard.

Expected outcome:

The report scores the hook as weak, improves the opening question, and rewrites the post with clearer business value.

Using "viral-verification". A founder thread about lessons from a failed hiring process.

Expected outcome:

The skill highlights strong narrative tension, suggests tighter pacing, and produces a more direct final version.

Using "viral-verification". A batch of Markdown drafts in the configured outputs folder.

Expected outcome:

The script creates verification reports in the viral-verified-posts output folder for unprocessed drafts.

Security Audit

High Risk
v10 โ€ข 7/7/2026 Open versioned report

The command-execution findings are false positives caused by TypeScript template literals and Markdown code fences. Real concerns remain: the script loads a parent .env file, reads local input files, uses API credentials, and sends content to an external model endpoint. The skill needs clear disclosure, path restrictions, and safer secret handling before broad publication.

2
Files scanned
290
Lines analyzed
11
Review items
0
False positives ignored

Confirmed security concerns (5)

High
index.ts:9
Environment file access
const envPath = path.join(projectRoot, '.env');
The code constructs a path to a parent .env file. Targeting that sensitive file is real secret-access behavior.
High
index.ts:20
Environment file access
const ANTHROPIC_API_KEY = process.env.ANTHROPIC_API_KEY;
The code reads the API key that may have been loaded from .env. This is direct handling of a secret value.
High
index.ts:109-116index.ts:125-129index.ts:160-167
Local File Content Sent to External Model Service
index.ts reads a local file, builds a prompt, and submits it through the Anthropic SDK. User-provided absolute paths are allowed, so sensitive files could be disclosed if selected.
The data flow from argv file path to readFileSync and messages.create is direct. The code does not restrict user-supplied paths to SOURCE_DIR.
High
index.ts:20-36index.ts:109-116
Configurable Model Endpoint Can Receive Secrets and Content
The client uses ANTHROPIC_BASE_URL as baseURL while also passing ANTHROPIC_API_KEY. A custom endpoint could receive file content and credentials.
The baseURL override and API key are both passed to the SDK client. Custom endpoints can be legitimate, so confidence is high enough to flag but not absolute.
Medium
SKILL.md:15-22SKILL.md:24-31
Engagement Manipulation Guidance
The skill asks the model to maximize viral engagement using anger, fear, surprise, and other high-arousal emotions. This can support manipulative social media messaging.
The prompt explicitly optimizes for viral potential and high-arousal emotions. It is framed as content growth, so this is a misuse-risk finding rather than clear malware.
Capability review items (11)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High
index.ts:128
Node.js fs operations
const content = fs.readFileSync(filePath, 'utf-8');
filePath can come from a user-supplied argument and is not constrained to the source directory. The file contents are then sent to the model call, creating local data disclosure risk.
High
index.ts:128
Synchronous file operations
const content = fs.readFileSync(filePath, 'utf-8');
The synchronous read can load any path accepted from the command line. Because that content is submitted to the model API, the read is security-relevant.
High
index.ts:8
Path resolve with ..
const projectRoot = path.resolve(__dirname, '../../');
The script resolves two parent directories above the skill folder. This is not user-controlled traversal, but it enables parent-scope .env and output access.
High
index.ts:8
Path traversal sequence
const projectRoot = path.resolve(__dirname, '../../');
The ../../ sequence intentionally moves outside the skill directory. That broader filesystem scope is security-relevant for a marketplace skill.
High
index.ts:20
Generic API/secret keys
const ANTHROPIC_API_KEY = process.env.ANTHROPIC_API_KEY;
The script reads the ANTHROPIC_API_KEY secret from the environment. This key is used for outbound SDK calls and must be treated as sensitive.
High
index.ts:35
Generic API/secret keys
apiKey: ANTHROPIC_API_KEY || 'dummy',
The API key is passed into the Anthropic client. This is expected for API use, but it is high-impact secret handling in a marketplace skill.
Medium
index.ts:18
dotenv library
dotenv.config({ path: envPath, override: true });
dotenv loads a parent-scope .env file with override enabled. This can replace existing environment configuration and expose secrets to the script.
Low
index.ts:20
Environment variable access (dot notation)
const ANTHROPIC_API_KEY = process.env.ANTHROPIC_API_KEY;
The code reads ANTHROPIC_API_KEY from the environment. This is expected for the SDK, but it is still sensitive secret access.
Low
index.ts:21
Environment variable access (dot notation)
const ANTHROPIC_BASE_URL = process.env.ANTHROPIC_BASE_URL;
The code reads ANTHROPIC_BASE_URL and later passes it as the SDK endpoint. This is legitimate configuration but security-relevant because it can redirect API traffic.
Low
index.ts:20
Environment variable object
const ANTHROPIC_API_KEY = process.env.ANTHROPIC_API_KEY;
This duplicate process.env access points to the same API key read. It is sensitive environment access, even though the use is expected.
Low
index.ts:21
Environment variable object
const ANTHROPIC_BASE_URL = process.env.ANTHROPIC_BASE_URL;
This duplicate process.env access points to endpoint configuration. It is security-relevant because the value controls where model traffic is sent.

Risk Factors

โš™๏ธ External commands (15)
index.ts:11 index.ts:48 index.ts:66-95 index.ts:95-107 index.ts:107-132 index.ts:132-135 index.ts:142-145 index.ts:145-147 index.ts:147-168 index.ts:168-179 SKILL.md:14-73 SKILL.md:73-77 SKILL.md:77-81 SKILL.md:81-87 SKILL.md:87-91
๐Ÿ“ Filesystem access (16)
index.ts:30 index.ts:45 index.ts:76 index.ts:87 index.ts:128 index.ts:144 index.ts:12 index.ts:29 index.ts:73 index.ts:81 index.ts:86 index.ts:45 index.ts:128 index.ts:144 index.ts:8 index.ts:8
๐Ÿ”‘ Env variables (8)
index.ts:20 index.ts:21 index.ts:20 index.ts:21 index.ts:3 index.ts:18 index.ts:20 index.ts:35
Audited by: codex View Audit History โ†’
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/wangdefou-dev-viral-verification/audits/10?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/wangdefou-dev-viral-verification/security.svg)](https://skillstore.io/skills/wangdefou-dev-viral-verification?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/wangdefou-dev-viral-verification?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/wangdefou-dev-viral-verification/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/wangdefou-dev-viral-verification.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA ยท BibTeX ยท CFF)

APA citation

wangdefou-dev. (2026). viral-verification security audit report (audit version 10) [Author version unspecified]. Skillstore. https://skillstore.io/skills/wangdefou-dev-viral-verification/audits/10

BibTeX citation

@techreport{wangdefou-dev-wangdefou-dev-viral-verification-2026, author = {wangdefou-dev}, title = {viral-verification security audit report (audit version 10)}, institution = {Skillstore}, year = {2026}, number = {10}, url = {https://skillstore.io/skills/wangdefou-dev-viral-verification/audits/10}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "viral-verification security audit report (audit version 10)" version: "unspecified" type: report authors: - name: "wangdefou-dev" date-released: "2026-07-07" url: "https://skillstore.io/skills/wangdefou-dev-viral-verification/audits/10" identifiers: - type: other value: "skillstore:wangdefou-dev-viral-verification:audit:10" description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium
55
Architecture
85
Maintainability
87
Content
71
Community
83
Spec Compliance

What You Can Build

Improve Launch Posts

Review launch copy before posting and receive stronger hooks, clearer value, and a cleaner final draft.

Audit Social Calendars

Score scheduled posts and find weak drafts before they reach the publishing queue.

Coach Content Writers

Show writers which viral factors are missing and provide concrete revision targets.

Try These Prompts

Score One Draft 
Review this draft for viral potential. Score each factor and give three practical improvements: [paste draft].
Rewrite With Constraints 
Review and rewrite this post. Keep the claim accurate, keep the tone calm, and improve the opening hook: [paste draft].
Compare Two Versions 
Compare these two drafts. Explain which version has stronger viral factors, then create a final merged version: [paste drafts].
Batch Review Plan 
Review these drafts as a campaign set. Rank them, identify repeated weaknesses, and suggest a revision plan: [paste drafts].

Best Practices

  • Provide the full draft and explain the target audience before asking for a rewrite.
  • Review factual claims after every rewrite before publishing.
  • Use scores as editing signals, not as guaranteed engagement predictions.

Avoid

  • Do not use the rewrite to exaggerate claims or remove important context.
  • Do not process confidential drafts without approval for external model use.
  • Do not optimize for outrage when the topic requires accuracy and care.

Frequently Asked Questions

What does this skill evaluate?
It evaluates curiosity, emotion, value, relevance, pacing, and novelty in draft social content.
Does it guarantee viral performance?
No. It provides model-based editing guidance, but audience response depends on many external factors.
Can it rewrite my post?
Yes. The core prompt asks for a final optimized version after scoring and diagnosis.
Does the script use local files?
Yes. The automation reads Markdown drafts from local paths and writes Markdown reports to an output folder.
Does automated use require an API key?
Yes. The script uses the Anthropic SDK and reads Anthropic configuration from environment variables.
Which tools does it support?
The marketplace metadata lists support for Claude, Codex, and Claude Code workflows.

Developer Details

License

MIT

Skillstore revision

r1

Version notice

The author did not declare a version.

Repository

https://github.com/wangdefou-dev/defou-workflow-agent/tree/main/skills/viral-verification

Ref

36e07d5e13068e5be64447e8f20b427cf2cbd21a

Maintenance freshness

7/18/2026

Usage

36 downloads ยท 237 views

File structure

๐Ÿ“„ index.ts

๐Ÿ“„ SKILL.md