Content Repurposer Pro

PassAudited by VirusTotal on May 11, 2026.

Overview

Type: OpenClaw Skill Name: gia-content-repurposer Version: 1.0.0 The skill bundle is a legitimate tool for repurposing long-form content into social media posts using LLM APIs. The code in scripts/repurpose.js correctly handles environment variables for API keys, performs standard HTTP requests to official OpenAI/Anthropic endpoints, and includes basic text extraction logic without any evidence of data exfiltration, obfuscation, or malicious intent.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Private drafts, internal articles, or pasted content may leave your environment and be processed by OpenAI or Anthropic.

Why it was flagged

The script sends generated prompts to external LLM provider APIs. Those prompts include the user-provided URL/file/stdin content being repurposed.

Skill content
httpPost('https://api.openai.com/v1/chat/completions' ...); ... httpPost('https://api.anthropic.com/v1/messages' ...)
Recommendation

Only process content you are allowed to send to those providers, or modify the script to use an approved local or enterprise model.

What this means

If you run it with an API key, requests may bill or count against that provider account.

Why it was flagged

The script uses provider API keys from the environment. This is expected for LLM generation, but it is not reflected in the registry's declared credentials or required env vars.

Skill content
const openaiKey = process.env.OPENAI_API_KEY; const anthropicKey = process.env.ANTHROPIC_API_KEY;
Recommendation

Use a scoped/project API key where possible, monitor usage, and treat the missing metadata declaration as an installation documentation issue.

What this means

A malicious or noisy source article could cause the generated posts to include unwanted wording, links, or calls to action.

Why it was flagged

The source content is placed directly into the LLM prompt. If that content contains prompt-injection-style instructions, it could influence the generated drafts.

Skill content
`Repurpose the following content:\n\n${content}`
Recommendation

Review generated content before posting or emailing it, especially when the source is a third-party URL.