Awesome Submitter Pro

PassAudited by ClawScan on May 1, 2026.

Overview

This looks like a coherent marketing helper for drafting GitHub awesome-list submissions, with only user-review notes around public posting and example shell commands.

Before installing, confirm you want a tool focused on GitHub awesome-list marketing submissions. Review every generated issue or PR before posting, avoid spammy or irrelevant submissions, and inspect the packaged shell script before running it.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI02: Tool Misuse and Exploitation

What this means

A user or agent could produce public GitHub submissions that appear promotional or unwanted if not reviewed for fit and repository rules.

Why it was flagged

The skill guides users toward creating public GitHub issues or PRs. This is purpose-aligned and manual, but it can affect public repositories and the user's reputation if used carelessly.

Skill content

### Via Issue
1. Go to repo → Issues → New Issue
2. Title: "Add [Product Name]"
3. Body: Use the generate template
4. Submit

Recommendation

Review each generated issue or PR before posting, confirm the project genuinely fits the list, and follow the repository's contribution guidelines.

Low

#ASI05: Unexpected Code Execution

What this means

If a user copies the snippet and fills variables from untrusted text, unusual quoting could cause local command errors or unintended Python execution.

Why it was flagged

The documentation includes a copyable shell/Python URL-encoding example that interpolates shell variables into Python source. It is not auto-executed by the skill, but blindly adapting it with untrusted text could break the command or execute unexpected Python.

Skill content

python3 -c "import urllib.parse; print(urllib.parse.quote('$TITLE'))"

Recommendation

Treat the snippet as an example only; pass values to Python as arguments or use a safer URL-encoding tool when automating.

Info

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Users may not expect a runnable helper script in an instruction-only skill package.

Why it was flagged

The package is described as instruction-only while also shipping a shell script. The visible script content is aligned with the skill's purpose and no auto-run mechanism is shown, but the packaging should be noticed.

Skill content

No install spec — this is an instruction-only skill. Code file presence: 1 code file(s): script.sh (11753 bytes)

Recommendation

Install only from the trusted source and review the included script before running it manually.