Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
AI Automation Agency Builder — Launch a $10K/Month Automation Agency in 30 Days
v1.0.0Identifies businesses with manual workflows, generates personalized automation audits, ROI calculations, service menus, and client pitch videos to launch an...
⭐ 0· 66·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill claims to perform large-scale web scraping (LinkedIn, Google Maps, Glassdoor, Reddit, website crawling) and to call third‑party services (Apify, InVideo AI, Claude). Yet it declares no required binaries, no install steps, and no required environment variables or API keys. Realistically, using Apify or InVideo requires API credentials and/or runtime dependencies (headless browser, scraper runtime). This is an internal inconsistency: either the SKILL.md is aspirational or it omits required credentials/install steps.
Instruction Scope
The runtime instructions direct scraping of multiple external platforms and aggregation of signals (job postings, Glassdoor reviews, tech-stack detection) to infer internal workflows and calculate ROI. That scope implies collection of business data and potentially personal data (employee roles, public LinkedIn entries). The SKILL.md gives broad authority to gather data from many sources and to synthesize personalized audits, but it does not limit or document what data is collected, how consent/ToS issues are handled, or where scraped data is stored or sent.
Install Mechanism
This is an instruction-only skill with no install spec or code files. While lower-risk from the platform-execution perspective, it's unrealistic for the claimed behavior. Heavy scraping and video generation normally require runtime components (Apify actors, headless browsers, API clients). The absence of an install mechanism raises questions about how the skill would actually run those steps and whether hidden runtime requirements or external services are assumed.
Credentials
The SKILL.md explicitly references Apify, InVideo AI, and Claude — services that normally require API keys or accounts — but the skill declares no required environment variables or primary credential. This is disproportionate: either the skill expects the agent environment to already have those credentials (not declared) or it omits necessary setup. Lack of declared credential needs prevents users from assessing data access risk (who owns the API calls, where data is billed/stored).
Persistence & Privilege
The skill does not request persistent/always-on presence (always: false) and uses default autonomy. It does not declare any special system-level config paths or modifications. There is no evidence in the package that it will modify other skills or system settings.
What to consider before installing
Proceed cautiously. Ask the publisher/developer to clarify: (1) exactly how Apify, InVideo AI, and Claude are invoked — do you need to supply API keys or accounts, and if so which environment variables will be required? (2) where and how scraped data (including any personal data) is stored, who pays for API usage, and whether any external endpoints receive data; (3) how the skill handles platform Terms of Service and rate limits (LinkedIn/Google Maps scraping often violates TOS); and (4) a reproducible install/run recipe or an explicit statement that it uses only public-API endpoints. Do not provide your API credentials or production account tokens until you receive clear answers. Consider testing in a sandbox account, and verify the skill's privacy/legal posture for scraping before using it on real targets.Like a lobster shell, security has layers — review code before you run it.
latestvk97fx27xqe8s59sve2fxgqdc0583va94
License
MIT-0
Free to use, modify, and redistribute. No attribution required.