Content Repurposer Pro

PassAudited by ClawScan on May 1, 2026.

Overview

This skill appears to do what it says, but it uses external LLM APIs, so supplied content may be sent to OpenAI or Anthropic.

This looks like a straightforward content-drafting helper. Before installing or using it, be aware that it needs Node.js and an OpenAI or Anthropic API key even though the registry metadata does not declare those requirements. Do not run it on confidential material unless sending that content to the selected LLM provider is acceptable, and review all generated posts before publishing or emailing them.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Private drafts, internal articles, or pasted content may leave your environment and be processed by OpenAI or Anthropic.

Why it was flagged

The script sends generated prompts to external LLM provider APIs. Those prompts include the user-provided URL/file/stdin content being repurposed.

Skill content
httpPost('https://api.openai.com/v1/chat/completions' ...); ... httpPost('https://api.anthropic.com/v1/messages' ...)
Recommendation

Only process content you are allowed to send to those providers, or modify the script to use an approved local or enterprise model.

What this means

If you run it with an API key, requests may bill or count against that provider account.

Why it was flagged

The script uses provider API keys from the environment. This is expected for LLM generation, but it is not reflected in the registry's declared credentials or required env vars.

Skill content
const openaiKey = process.env.OPENAI_API_KEY; const anthropicKey = process.env.ANTHROPIC_API_KEY;
Recommendation

Use a scoped/project API key where possible, monitor usage, and treat the missing metadata declaration as an installation documentation issue.

What this means

A malicious or noisy source article could cause the generated posts to include unwanted wording, links, or calls to action.

Why it was flagged

The source content is placed directly into the LLM prompt. If that content contains prompt-injection-style instructions, it could influence the generated drafts.

Skill content
`Repurpose the following content:\n\n${content}`
Recommendation

Review generated content before posting or emailing it, especially when the source is a third-party URL.