Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Gingiris Opensource
v2.0.0GitHub Stars Growth & Open Source Marketing Playbook — How to get 10k+ GitHub stars. Complete OSS launch strategy from AFFiNE (33k stars in 18 months). Cover...
⭐ 0· 354·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description and all included files are a consistent OSS launch / growth playbook. The requested artifacts (templates, channel lists, KOL pricing, automation tools) align with a marketing playbook — there is no obvious mismatch between purpose and content.
Instruction Scope
SKILL.md and referenced docs explicitly instruct use of automation (Phantombuster, Opencord.ai, auto‑comment workflows), scraping follower lists, using high‑karma accounts, asking people to upvote, and mass distribution (50–100 groups/day). Those steps broaden scope from benign documentation to recommending potentially rule‑breaking or deceptive operations (vote manipulation, sockpuppets, mass unsolicited DMs) and give an agent wide latitude if run autonomously.
Install Mechanism
Instruction‑only skill with no install spec and no code files — lowest risk from installation. Nothing is written to disk by the skill itself.
Credentials
The docs reference services and credentials (Phantombuster/Opencord/Sheet0, IndexNow curl with a key, accounts for HN/Reddit/Twitter) but the skill declares no required env vars or credentials. If an agent were to act on these instructions it would need third‑party API keys/accounts that are not declared or scoped here — a gap that could lead to secrets being used unsafely or requested ad hoc.
Persistence & Privilege
Skill does not request persistent privileges (always: false). It is invocable and can be used by an agent, which is the platform default; there are no install hooks or changes to agent/system configuration requested.
What to consider before installing
This skill is essentially a human‑readable marketing playbook — it appears to be what it says — but it contains several practical and ethical red flags you should consider before using it with an autonomous agent or providing any credentials:
- The docs recommend using automation tools (Phantombuster, Opencord.ai, Sheet0), scraping follower lists, and 'finding people to help upvote' or using high‑karma/sockpuppet accounts. Those tactics can violate platform terms of service (Reddit, Hacker News, Twitter/X, GitHub) and could lead to account bans or worse. Avoid vote manipulation and sockpuppetry.
- The playbook demonstrates commands that require secret keys (IndexNow curl example) and presumes access to third‑party services. The skill metadata declares no env vars — do not paste sensitive API keys into an agent running this skill unless you explicitly trust it and understand how the keys will be used and stored.
- If you plan to let an agent act autonomously, restrict network and account access, and avoid granting credentials to automation services unless you audit them first. Prefer manual execution of contested actions (submissions, paid KOL deals, large‑scale posting).
- Verify the author's provenance (source is unknown here; README lists social links and email) before spending money on KOLs or running large campaigns. Check the MIT license and contact the author if you need clarifications about recommended tools or legal/ethical implications.
Recommended immediate actions before installing/using:
1) Treat this as documentation only; do not enable any autonomous web‑posting capability without an explicit safe plan. 2) If you need to use automation tools, create dedicated accounts with limited privileges and do not reuse high‑trust personal accounts. 3) Review platform TOS for each channel you plan to use. 4) If you want the agent to help execute tasks, require explicit prompts and never provide permanent API keys to the skill without manual review.Like a lobster shell, security has layers — review code before you run it.
latestvk973sbc1qsgt5h17kwdmmp8n0h83hz48
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
