Creator Casting Tool
v1.0.0Find the right creators for any brand campaign, activation, or ambassador program. Takes a campaign brief (brand, vibe, category, budget, audience), searches...
⭐ 0· 57·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description match the instructions: the SKILL.md instructs cross-platform discovery, profile collection, conflict checks, and rate estimation. Requiring web_search and web_fetch (and optionally gram CLI for richer Instagram data) is proportionate to the stated purpose.
Instruction Scope
Instructions are limited to web discovery and profile aggregation and do not ask to read local files or unrelated env vars. Note: it tells the agent to run gram CLI commands if present and to fetch profile pages via web_fetch; those external tools could access or surface additional data (for example, a locally logged-in gram client might use local Instagram credentials). Also be aware of scraping/legal compliance when fetching platform content.
Install Mechanism
No install spec and no code files — instruction-only skill. This minimizes disk/write risk.
Credentials
The skill declares no required env vars or credentials, which is appropriate. However, optional use of a local gram CLI and mandatory use of web_fetch/web_search imply reliance on external tooling that may itself use or require credentials (not declared here). Confirm what those tools have access to before running.
Persistence & Privilege
always is false, the skill does not request persistent presence or attempt to modify agent/system configs. It appears limited to runtime instruction execution.
Assessment
This skill appears coherent and low-risk as an instruction-only tool, but consider: 1) Confirm the agent's web_search/web_fetch tools are trusted and you are comfortable with them fetching public pages; 2) If you have a local 'gram' CLI, check whether it uses stored Instagram credentials — the skill will call it if present but does not declare or request those creds; avoid providing sensitive or account credentials to the agent; 3) Be mindful of third-party platform Terms of Service and scraping/rate limits when the skill fetches large numbers of profiles; 4) If you want tighter control, run a test with non-sensitive dummy briefs first and review the fetched results; 5) If the agent offers logs or an approval step for web_fetch calls, enable them so you can monitor what pages are fetched.Like a lobster shell, security has layers — review code before you run it.
latestvk979pv6q4nksva71xk8vbdn0wd849dx5
License
MIT-0
Free to use, modify, and redistribute. No attribution required.