ProposalKit
v1.0.2One-click business proposal package generator. Takes a brief project/service description and generates a COMPLETE ready-to-send package: proposal (.docx), pi...
⭐ 0· 208·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The name/description (generate coordinated proposal assets) match the runtime instructions (gather brief, build content plan, produce .docx/.pptx/.xlsx/.pdf). It asks to save outputs to a user data path and to present files, which is expected for this functionality.
Instruction Scope
The SKILL.md gives detailed, scoped instructions for building documents and only references reading specific template/instruction files under /mnt/skills/public/<format>/SKILL.md before generating each artifact. Those paths are reasonable for a templated-generator but the package being evaluated contains no such sub-files; this is an inconsistency to verify (are templates provided by the runtime or missing from this skill?). The triggers described are broad (activate whenever a user mentions proposals/etc.), which could lead to frequent automatic activation unless the agent's trigger rules are tuned.
Install Mechanism
No install spec and no code files — instruction-only skill. This is the lowest-risk install model; nothing is written to disk by an installer step.
Credentials
The skill requests no environment variables, no credentials, and no config paths beyond writing outputs to /mnt/user-data/outputs/. There are no signs of unnecessary credential access or unrelated service tokens.
Persistence & Privilege
always is false and model invocation is allowed (platform default). The skill does not request persistent privileges or modify other skills; it only writes files to a standard user-output directory.
Assessment
This skill appears coherent for generating proposal packages, but check two things before installing: (1) verify where the referenced template files (/mnt/skills/public/.../SKILL.md) are expected to come from — if they are missing the skill may fail or try to infer templates at runtime; (2) beware the broad trigger wording: it may activate any time a user mentions 'proposal'-type phrases unless your agent's trigger rules are narrower. The skill does not request any credentials or perform installs, and it only writes outputs to your user-data directory, but you should review a sample generated package and confirm the skill will not transmit generated documents to external services you don't control.Like a lobster shell, security has layers — review code before you run it.
agencyvk971mvskc2mz54d8r02r67vbtx82hybtbusinessvk971mvskc2mz54d8r02r67vbtx82hybtfreelancevk971mvskc2mz54d8r02r67vbtx82hybtlatestvk971mvskc2mz54d8r02r67vbtx82hybtpitchvk971mvskc2mz54d8r02r67vbtx82hybtproposalvk971mvskc2mz54d8r02r67vbtx82hybt
License
MIT-0
Free to use, modify, and redistribute. No attribution required.