Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Japan Media Agent
v1.0.0Japan-focused social media agent for Pinterest JP, X (Twitter) JP, Instagram JP, and note.com. Handles content strategy, copywriting, and publishing for Japa...
⭐ 0· 53·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
SKILL.md claims publishing to Pinterest, X, Instagram, and note plus image generation (mentions 'pinterest-browser-publisher', 'X API or browser automation', 'aura-image-gen'), but the manifest requests no environment variables, no credentials, and has no install spec. Posting to these platforms or running browser automation normally requires API keys, OAuth tokens, or installed automation tooling — their absence is an incoherence.
Instruction Scope
Instructions are detailed for copywriting and scheduling and include a '投稿実行' step listing automation tools. The instructions do not tell the agent to read unrelated local files or secrets, but they are vague about how publishing and automation are performed (API vs browser automation) and give the agent broad discretion to use unspecified external tools.
Install Mechanism
This is an instruction-only skill with no install spec and no code files. That reduces on-disk execution risk, but also means any external tooling the agent needs must be supplied at runtime — which is not documented.
Credentials
No environment variables or primary credential are declared, yet the skill implies it will interact with multiple third-party services (Pinterest, X, Instagram, note, aura-image-gen). Legitimate publishing would require service credentials or OAuth flows; not declaring them is disproportionate and unclear.
Persistence & Privilege
Skill is not forced-always, is user-invocable, and does not request system-level persistence. There are no signs it would modify other skills or system config.
What to consider before installing
This skill reads like a policy/style guide plus an automation playbook, but it does not declare the credentials or tools needed to actually publish or generate images. Before installing or enabling it: (1) Ask the author for source code or a homepage and a clear list of required credentials, OAuth flows, or external services (e.g., Pinterest API key, X developer token, Meta/Instagram business credentials, note.com auth, aura-image-gen endpoint). (2) Confirm whether publishing is manual (agent drafts content for you to post) or autonomous (agent will post using provided tokens). Never hand over long-lived account credentials to a skill you don't trust — prefer OAuth with limited scopes or use test/sandbox accounts. (3) If browser automation is used, ask which tooling will run (local headless browser, remote service) and where those binaries run. (4) If you want to proceed, limit the skill to user-invocation only and test on non-critical accounts first. If the author cannot explain the missing credentials/install steps, treat the skill as untrusted.Like a lobster shell, security has layers — review code before you run it.
latestvk97e1tc2sf31qfbzbfdagxrq7d83jjjn
License
MIT-0
Free to use, modify, and redistribute. No attribution required.