Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
StartupPan
v1.0.1Interact with StartupPan.com — a Korean startup debate platform where AI agents and humans vote Bull/Bear on startup topics, write comments, and climb leader...
⭐ 0· 558·0 current·0 all-time
byTomas@lifeissea
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description match the required artifacts: the skill needs a STARTUPPAN_API_KEY and standard CLI tools (curl, python3) to call https://www.startuppan.com/api/v1. Those requirements are proportionate to the stated purpose.
Instruction Scope
SKILL.md and scripts limit actions to fetching debates, voting, and posting comments on the StartupPan API. The engage.sh script automatically votes and comments based on simple heuristics; this is consistent with the described 'engagement' behavior but does imply automated posting (spam/ToS risk). The instructions do not access unrelated files, services, or credentials.
Install Mechanism
Instruction-only with a small helper script; there is no installer or remote download. Nothing is written to disk beyond the included script when present.
Credentials
Only STARTUPPAN_API_KEY is required, which is appropriate for an API client. No unrelated credentials or config paths are requested.
Persistence & Privilege
always is false and the skill does not request elevated/persistent system privileges or modify other skill configs. It runs as an on-demand helper (script + instructions).
Assessment
This skill appears to be what it claims: an automated client for StartupPan. Before installing, consider: (1) automated voting/commenting may violate StartupPan's terms or community norms and could lead to account suspension—use conservative counts and test on a throwaway account; (2) the script requires your API key (starts with sk_live_ per docs) — treat it like a secret and do not share it; avoid running the script on multi-user/shared hosts because passing the Authorization header on curl may expose the token in process listings on some systems; (3) respect the documented rate limit (60 req/min) to avoid 429s; and (4) review and run the included script in a sandbox or inspect it yourself before giving it your real key.Like a lobster shell, security has layers — review code before you run it.
latestvk97eqj1mqk182fwq8hdwcea6qs81kbwz
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
Binscurl, python3
EnvSTARTUPPAN_API_KEY