Newsletter Generator
v1.0.0Generate automated email newsletters with curated content, affiliate links, and personalized recommendations. Use when creating daily/weekly newsletters, building email lists, or monetizing subscriber engagement with affiliate content.
⭐ 1· 1.9k·1 current·1 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
The name/description promise curated content, affiliate integration, analytics, scheduling, and personalization. The bundled code only provides two Python scripts that generate newsletters from hard-coded mock data and write local files. There are no implementations for affiliate network APIs, analytics ingestion, ESP integration, or real RSS fetching. Several capabilities documented in SKILL.md (add_affiliate_links.py, schedule_newsletter.py, analytics_report.py) are referenced but not present. Requiring no credentials while advertising integrations that normally need API keys (ESP, affiliate networks, analytics) is inconsistent.
Instruction Scope
SKILL.md instructs the agent to run various scripts and to curate from RSS feeds / add affiliate links / schedule newsletters. The curate script accepts rss URLs but uses MOCK_RSS_DATA and does not perform network requests or real RSS parsing. SKILL.md references scripts that are not in the bundle. The instructions therefore over-promise and give the agent discretion to perform operations that the included code does not implement — this is confusing and could lead to incorrect assumptions about what will actually happen at runtime.
Install Mechanism
No install specification and the skill is primarily instruction + small Python scripts. Nothing is downloaded from external URLs and no install operations write code to the system. This is low-risk from an install/mechanism perspective.
Credentials
The skill declares no required environment variables or credentials, yet SKILL.md describes integration with affiliate networks, ESPs, and analytics (which typically require API keys/tokens). The absence of declared env vars is inconsistent with the claimed features. If the skill were extended to contact affiliate/ESP APIs it would need credentials — the current manifest does not request them or document how secrets would be used.
Persistence & Privilege
The skill does not request always:true and has no install hooks or code that modifies other skills or system-wide settings. It appears to run only as invoked and writes outputs locally (markdown/JSON files). No elevated persistence is requested.
What to consider before installing
This skill's documentation promises many integrations (RSS crawling, affiliate networks, analytics, scheduling) but the shipped code only generates newsletters from hard-coded mock data and writes local files; several scripts mentioned in the README are missing. Before installing or using it in production: 1) Ask the author for the missing scripts and a clear explanation of which external services the skill will contact and what credentials it needs. 2) Inspect any additional code that will perform network I/O or require API keys — ensure it only uses minimal, service-specific credentials and does not exfiltrate sensitive data. 3) Test the skill in a sandbox (no real credentials) to confirm actual behavior. 4) If you need affiliate/ESP integration, require the skill to explicitly declare the needed environment variables and document how tokens are stored/used. Given the current mismatch between claims and code, do not assume it performs the advertised integrations until the author provides complete, auditable code.Like a lobster shell, security has layers — review code before you run it.
latestvk97fa19m8aczg2h4ef05y4fft180hmc6
License
MIT-0
Free to use, modify, and redistribute. No attribution required.