Social Content Pro

This skill appears functionally consistent for generating simulated content locally (viral hooks, hashtag suggestions), but it also advertises auto-posting, analytics, and competitor analysis without documenting how to connect real social accounts or where needed credentials come from. Before installing or providing any API keys: - Ask the author/maintainer: what is the constructor apiKey used for, and how do you connect real social accounts (OAuth flow, where are tokens stored)? - Inspect the rest of index.js (full file) for any network calls (fetch/https/request/axios) or hardcoded endpoints. If any exist, ask what endpoints are contacted and why. - If you plan to enable auto-posting, require explicit instructions about OAuth flows and where tokens are stored; never paste platform OAuth tokens into a skill without understanding the endpoint and storage. - Run the included tests locally in an isolated environment to see whether the module simulates data or actually attempts network access. Monitor outbound network traffic while running tests. - Prefer skills that clearly document required credentials and show secure token handling; if the skill only simulates analytics/competitor data, treat pro features (auto-post) as marketing claims unless proven otherwise. Given the omission of integration details and credentials, proceed cautiously — the code likely works as an offline generator, but the advertised live integrations are unproven and under-documented.

These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.