Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Daily Prospection Intel
v1.0.0Generates a daily .docx report identifying 8 specific European regulatory opportunities in pharma for ArcaScience's BRA platform, prioritizing recent EMA dev...
⭐ 0· 47·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The name/description and the SKILL.md align: the skill performs web research and compiles an 8-target regulatory intelligence .docx for ArcaScience. However the instructions reference an internal path (arcascience_dossiers/companies/) and expect docx-js for .docx generation even though the skill bundle declares no install spec or required binaries. The internal dossier path is not present in the file manifest — this mismatch should be clarified.
Instruction Scope
The runtime instructions require broad web searches and producing ready-to-send outreach emails (expected for a sales/intel skill). Concerns: (1) SKILL.md instructs the agent to reference local dossier files at arcascience_dossiers/companies/, but that path is not declared or present in the included files — the instruction could prompt the agent to search arbitrary local paths if they exist; (2) it explicitly mentions being triggered by a cron job, but the registry metadata contains no install/cron configuration — unclear how/when auto-triggering occurs; (3) the Email Template rules produce ready-to-send messages that could contain sensitive, personalized content — user should confirm compliance and consent before automating outbound outreach.
Install Mechanism
This is an instruction-only skill with no install spec or code files, so nothing is written to disk by the bundle itself (low install risk). One minor note: SKILL.md instructs generation of .docx 'using docx-js' — there is no install step declaring docx-js availability; the agent environment must provide that dependency or fallback behavior should be defined.
Credentials
The skill requests no environment variables or credentials (proportionate). However it asks the agent to reference a local dossier path (arcascience_dossiers/companies/) and to save output to the workspace without declaring config paths — this is an unexplained dependency on internal files and could lead to accidental access of internal data if present.
Persistence & Privilege
No elevated privileges requested. always is false and the skill does not claim to modify other skills or system settings. Autonomous invocation is permitted by default (disable-model-invocation:false) — that is normal but combine with other flags if you want stricter control.
What to consider before installing
What to check before installing:
1) Missing internal path: SKILL.md tells the agent to reference arcascience_dossiers/companies/ if available, but that path is not present in this bundle. Ask the publisher: is the skill expected to run inside ArcaScience's internal environment with that folder? If so, installing it in a different workspace could cause the agent to attempt to read unrelated local files. Consider running in a sandbox first.
2) docx-js dependency: The instructions require generating .docx via docx‑js but there is no install spec. Confirm that your agent runtime already has a docx library or request an explicit install step from the author; otherwise generation may fail or the agent may try to call external services.
3) Email outreach & compliance: The skill produces ready-to-send outreach emails using recent regulatory events and contact data. Ensure this behavior complies with your privacy/GDPR and internal sales/outreach policies. Disable autonomous invocation if you do not want the agent to automatically generate or send outreach content.
4) Cron/autotrigger ambiguity: The SKILL.md references a cron job trigger but the registry bundle provides no scheduling info. If you do not want daily automatic runs, verify how/where cron is configured and block or review scheduled triggers.
5) Test in a controlled environment: Run the skill in a sandbox workspace, verify the searches performed, the sources cited, and that no unexpected local files or secrets are accessed. Ask the publisher for clarifications or an updated SKILL.md that (a) removes or documents the arcascience_dossiers dependency, (b) declares any required libraries, and (c) states whether auto-scheduling will be configured.Like a lobster shell, security has layers — review code before you run it.
latestvk973v7j874bd5z5desq7as1q2183gr9c
License
MIT-0
Free to use, modify, and redistribute. No attribution required.