Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Brand Marketing Workflow
v2.1.0端到端品牌营销自动化工作流。从品牌输入到营销内容生产、竞品分析、 效果评估的完整闭环。支持小红书/微博/抖音多平台内容生成。
⭐ 0· 79·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The code modules (content_producer, competitor_fetcher, oc_llm_client, authorization_manager, etc.) are coherent with the marketing/competitor-analysis purpose. However the registry metadata claims 'required env vars: none' and 'instruction-only' while the package contains many Python scripts and an install.sh; SKILL.md also shows a placeholder ${KIMI_API_KEY} and optional Brave Search key. The omission of those required credentials from metadata is inconsistent.
Instruction Scope
SKILL.md instructs editing the agent config (~/.openclaw/openclaw.json) to add an LLM provider and API key, and to run run.py. Reading/editing ~/.openclaw/openclaw.json can expose other provider credentials stored there; the skill's instructions do not warn about limiting which keys are present. The README claims 'only public data' and 'no automatic publishing', which is good, but the runtime code (oc_llm_client.py and gateway_client.py) is present and will read user config and contact external LLM endpoints — this is expected but should be treated as sensitive because it uses the user's model config file.
Install Mechanism
Registry says 'No install spec — instruction-only', but the bundle contains an install.sh and 17+ scripts. There is no remote download/install from unknown URLs shown in the manifest, which lowers risk, but absence of a declared install step is inconsistent with included install.sh and code. Review install.sh before running; don't run unreviewed scripts as root or in your real environment.
Credentials
The skill metadata does not declare any required env vars, yet SKILL.md demonstrates use of ${KIMI_API_KEY} and mentions an optional Brave Search API Key. The code will read ~/.openclaw/openclaw.json to discover LLM providers — that file can contain multiple API keys for different providers. Asking to edit/read that config is reasonable for an LLM-driven skill, but the metadata should explicitly declare the primary credential(s). Because the skill will read a central agent config file, it has potential access to unrelated credentials stored there; treat that as a privilege and limit what you store in openclaw.json prior to running.
Persistence & Privilege
always:false and no indication the skill auto-enables itself in other skills. The SKILL.md asks you to edit your OpenClaw config manually (not to run an automatic config writer). Nothing in the provided docs claims permanent system-wide changes beyond reading/editing ~/.openclaw/openclaw.json. Still, inspect install.sh and run.py for any code that would modify other skills/configs before running.
What to consider before installing
This package contains substantial Python code and scripts despite being listed as 'instruction-only' and the SKILL.md asks you to edit your global OpenClaw config (~/.openclaw/openclaw.json). Before running: 1) Inspect oc_llm_client.py, gateway_client.py, and install.sh for network endpoints and any code that writes to ~/.openclaw or other system files. 2) Do not run install.sh or run.py with your real openclaw.json if it contains other provider keys — create a minimal test openclaw.json containing only a dedicated (limited) API key for testing, or run in STUB_MODE where supported (autoresearch.sh supports STUB_MODE=1). 3) If you plan to use competitor fetch, only provide the optional Brave Search key if comfortable; the skill also uses external fetching (jina/r.jina.ai in cached evidence). 4) Run the demos in a sandbox/container or with network traffic monitored, and read the output logs to confirm no unexpected outbound endpoints. 5) If you need this skill for production, ask the author to update registry metadata to declare required credentials (KIMI_API_KEY, optional BRAVE_API_KEY) and provide a clear install script and audit notes. These steps reduce the risk of accidental exposure of other keys in your OpenClaw configuration.Like a lobster shell, security has layers — review code before you run it.
latestvk9741czd7t4pb91rqn1m39426983nwxd
License
MIT-0
Free to use, modify, and redistribute. No attribution required.