Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Content Automation
v1.0.0内容创作自动化工具 Skill。支持社交媒体内容生成、视频脚本创作、定时发布任务管理。当用户需要批量生成内容、自动化社交媒体运营或创建视频脚本时触发。
⭐ 0· 57·1 current·1 all-time
byantonia huang@antonia-sz
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill claims to be a content-automation helper and the included examples match that purpose, but the SKILL.md requires cloning an external repository (MoneyPrinterV2) and handling platform credentials in a local config. The metadata declares no required env vars or credentials, which is inconsistent with the instructions that explicitly ask for OpenAI keys, Twitter credentials, YouTube client_secrets, and affiliate tags.
Instruction Scope
The SKILL.md instructs the user/agent to clone https://github.com/FujiwaraChoki/MoneyPrinterV2.git, create a venv, pip-install requirements, and place sensitive secrets into config.json. It also shows example code that would post to social platforms and schedule jobs. These steps involve executing third‑party code and storing/transmitting credentials in a manner not declared by the skill metadata; the instructions go beyond mere content generation guidance and require running code from an external source.
Install Mechanism
There is no formal install spec, but the README-style instructions direct cloning a GitHub repo and installing its requirements. GitHub is a common host, but the repo owner is unknown and arbitrary code would be executed on the user's machine if followed. The included quickstart script itself is benign and only checks for the repo/config, but the real behavior depends on the external repository.
Credentials
The skill metadata declares no required environment variables or primary credential, yet SKILL.md requires an openai_api_key, Twitter username/password/email, YouTube client_secrets.json, and affiliate settings in a config.json file. Asking for platform passwords and plaintext keys in a config file is disproportionate and risky; credentials are neither declared in the registry metadata nor scoped or justified (e.g., OAuth flow).
Persistence & Privilege
The skill is not set to always:true and is user-invocable; it does not request elevated platform privileges or attempt to modify other skills' configuration. The included script only provides a local quickstart/help check and does not persist beyond normal usage.
What to consider before installing
This skill's metadata says it needs nothing, but the SKILL.md tells you to clone and run a third‑party GitHub repo and to store sensitive credentials (OpenAI key, Twitter email/password, YouTube client_secrets) in a local config.json. Before installing or running anything: (1) review the referenced GitHub repository code (MoneyPrinterV2) thoroughly — do not run it blindly; (2) avoid putting passwords/API keys in plaintext configs — prefer OAuth and scoped API tokens or environment variables, and limit permissions for any tokens you create; (3) run the code in an isolated environment (dedicated VM or container) if you must test it; (4) verify that posting to social platforms uses official APIs and proper authentication (not raw username/password); and (5) if you cannot audit the external repo or if it requests full account credentials, do not install or use the skill. Document any secrets you supply and rotate them after testing.Like a lobster shell, security has layers — review code before you run it.
automationvk97f83aaa0h1h6v6m9k0mcx58h83ewxhcontentvk97f83aaa0h1h6v6m9k0mcx58h83ewxhlatestvk97f83aaa0h1h6v6m9k0mcx58h83ewxhscriptvk97f83aaa0h1h6v6m9k0mcx58h83ewxhsocial-mediavk97f83aaa0h1h6v6m9k0mcx58h83ewxhvideovk97f83aaa0h1h6v6m9k0mcx58h83ewxh
License
MIT-0
Free to use, modify, and redistribute. No attribution required.