Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Master Content Writer
v1.0.0Multi-platform content generator for Chinese social media. Produces publish-ready posts for 小红书, 知乎, 公众号, and 抖音 with platform-native formatting, hooks, and...
⭐ 0· 50·1 current·1 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The SKILL.md templates and workflow align with the declared purpose (multi-platform Chinese content generation). However, embedded metadata files are inconsistent: the registry metadata ownerId (kn71frak...) and slug (master-content-writer) do not match the _meta.json ownerId (kn7a1sn...) and slug (content-writer), and SKILL.md version (1.0.1) differs from _meta.json version (1.0.0). These provenance mismatches raise questions about origin and authenticity but do not by themselves show malicious intent.
Instruction Scope
The runtime instructions are focused on generating platform-native content and include clear templates and a checklist. They do not request files, environment variables, or external endpoints. One problematic item: the checklist references 'seo-optimizer' for cross-checking banned words without declaring that tool or how to access it — this is an undeclared dependency and could imply the skill expects another skill/tool to be available or may instruct the agent to call an external helper not described here.
Install Mechanism
Instruction-only skill with no install spec and no code files — lowest install risk. Nothing will be downloaded or written by an install step.
Credentials
The skill declares no required environment variables, credentials, or config paths. The requested access (none) is proportionate to the stated functionality.
Persistence & Privilege
always:false and default invocation settings. The skill does not request permanent/system-level presence or elevated privileges.
What to consider before installing
This skill appears to do what it says (produce Chinese social-media posts) and is low-risk technically because it’s instruction-only. However:
- The package metadata is inconsistent (different ownerId/slug/version between registry and _meta.json). That could be a benign packaging error or indicate the skill was copied/renamed — verify the publisher before trusting it.
- The SKILL.md references an undeclared helper 'seo-optimizer'. Ask the publisher what that is and how it integrates, or test the skill in a sandboxed environment to ensure it doesn’t try to call unexpected services.
- Because it’s a content generator, review output for plagiarism, factual accuracy, and compliance with platform rules before publishing. Do not provide any secrets or credentials to the skill; test it first with non-sensitive prompts.
If you rely on this for production/publishing, request provenance confirmation from the publisher (matching ownerId/slug/version and a homepage or contact) or prefer a skill from a known/trusted source.Like a lobster shell, security has layers — review code before you run it.
latestvk97akcnhem9fmfe3ejhs3ta57n84p8sg
License
MIT-0
Free to use, modify, and redistribute. No attribution required.