OpenClaw Marketing Skills

Security checks across malware telemetry and agentic risk

Overview

This is a coherent instruction-only marketing skill pack; the main things to notice are its shared product-context file and optional external AI/API examples.

This appears suitable if you want marketing strategy and copywriting guidance. Before installing or using it, be aware that product context saved in `.agents/product-marketing-context.md` may be reused by many skills, and optional API examples should only be run with trusted provider keys and non-sensitive prompt data.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Risk analysis

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

#
ASI06: Memory and Context Poisoning
Low
What this means

Product details written into the context file may be reused by later marketing tasks without being repeated.

Why it was flagged

The skill pack uses a persistent product-context file that is reused across tasks and skills. This is disclosed and purpose-aligned, but it can carry sensitive business context or stale instructions forward.

Skill content
Use `product-marketing-context` to create `.agents/product-marketing-context.md`. All other skills automatically reference this
Recommendation

Keep the context file scoped to non-secret product information, review it periodically, and avoid storing credentials, private customer data, or instructions you would not want reused.

#
ASI03: Identity and Privilege Abuse
Low
What this means

If you run these examples, your API key may incur provider usage and the prompt content may be sent to the external AI provider.

Why it was flagged

The reference documentation includes an optional external Gemini API example using an API key. No hardcoded key or automatic use is shown, but users running the example would be using provider credentials.

Skill content
curl -X POST "https://generativelanguage.googleapis.com/..." ... -H "x-goog-api-key: $GEMINI_API_KEY"
Recommendation

Use scoped API keys, protect them like passwords, review provider costs and data policies, and avoid sending confidential customer or business data unless appropriate.

#
ASI04: Agentic Supply Chain Vulnerabilities
Info
What this means

Manual installation means you trust the cloned repository at the time you copy it into your agent's skill directory.

Why it was flagged

The README documents a manual installation path that downloads a GitHub repository and copies skill files into the local agent skills directory. This is user-directed and expected, but it relies on the external repository's contents.

Skill content
git clone https://github.com/LeoYeAI/openclaw-marketing-skills.git
cp -r openclaw-marketing-skills/skills/* ~/.agents/skills/
Recommendation

Prefer the versioned ClawHub install path when possible, or inspect the cloned files before copying them into your agent skills folder.