Security audit
Security checks for vulnerabilities and agentic risk
This skill analyzes a user-provided social video link to adapt its content format, with disclosed use of social scraping tools and limited local note-saving.
Before installing, understand that this skill may send user-provided social media URLs to scraping or public-page tools, read captions/thumbnails/comments, and save the resulting adapted ideas plus the source link in local idea files. Avoid using it on private or sensitive posts unless you are comfortable sharing screenshots or context manually.
En un archivo markdown/manifest, los disparadores deben ser específicos para evitar invocaciones accidentales. Aquí se listan ejemplos concretos, pero la cláusula abierta "o cualquier variación" amplía el alcance de forma ambigua y sin ejemplos negativos o límites claros.
The OpenClaw section says Paso 1 should be done without a logged-in browser and specifically use Apify or public-page tooling, while the later process instructs opening the link 'logueada' with agent-browser for Instagram/TikTok. These instructions point to materially different behaviors for the same step, creating intent ambiguity about whether authenticated browser access is part of the skill.
The skill instructs the agent to access third-party content, inspect comments/captures, and persist outputs to local files, but it does not clearly require user-facing disclosure or consent about data handling and retention. In practice, this can lead to collection and storage of external content metadata, user-provided screenshots, and derived notes without transparent notice, creating privacy and governance risk—especially when posts are private or screenshots may contain personal data.
