CN Content Matrix

PassAudited by ClawScan on May 10, 2026.

Overview

This appears to be a normal content-generation skill, but it can search the web, create local draft files, and produce human-sounding publish-ready posts that should be fact-checked before publishing.

Before installing, be comfortable with the skill sending topic queries to web search, reading any draft file you explicitly ask it to review, and writing generated files under ~/content-output. Review the bundled shell script before running it, avoid confidential campaign topics unless you are comfortable exposing them to search, and carefully fact-check and ethically disclose publish-ready social content.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The agent may search the web and create or inspect local files as part of generating or reviewing content.

Why it was flagged

The skill requests broad tool access for a content-generation workflow. The visible instructions use research, file reads, and local file writes, but some permissions such as Edit, WebFetch, and Agent are broader than the core examples require.

Skill content
allowed-tools:\n  - Bash\n  - Read\n  - Write\n  - Edit\n  - Grep\n  - Glob\n  - WebSearch\n  - WebFetch\n  - Agent
Recommendation

Use it with non-confidential topics and drafts, and confirm any file paths or edits before allowing the agent to act outside the documented ~/content-output workflow.

What this means

Users have less external provenance to rely on when deciding whether to trust the included helper script.

Why it was flagged

The registry metadata does not provide an upstream source or homepage, while the package includes a shell helper script. No remote installer or package dependency risk is shown, but provenance is limited.

Skill content
Source: unknown; Homepage: none; No install spec — this is an instruction-only skill; 1 code file(s): scripts/content-check.sh
Recommendation

Review scripts/content-check.sh locally before executing it, and prefer installing from a known maintainer or repository when available.

What this means

Generated posts may sound like firsthand human endorsements even when the user has not personally verified the claims.

Why it was flagged

The skill intentionally optimizes generated social-media copy to appear platform-native and less AI-written. This is aligned with its content-creation purpose, but it can create audience-trust issues if used without disclosure or fact-checking.

Skill content
“reads like it was written by a real KOL” and “Anti-AI Detection — built-in rules to eliminate ‘AI smell’ phrases”
Recommendation

Fact-check all data and product claims, disclose sponsorships or AI assistance where appropriate, and do not fabricate personal experience, credentials, or sources.