Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Newsletter Curation

Newsletter curation with content sourcing, editorial structure, and subscriber growth strategies. Covers issue formatting, link roundups, commentary style, a...

MIT-0 · Free to use, modify, and redistribute. No attribution required.
0 · 490 · 0 current installs · 0 all-time installs
byÖmer Karışman@okaris
MIT-0
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description (newsletter curation) aligns with the SKILL.md: it provides templates, sourcing queries, and usage examples that call a content-sourcing CLI (infsh) and search apps (tavily, exa) to gather material for newsletters. The requested tools and commands are coherent with the stated goal.
Instruction Scope
Instructions stay within newsletter curation (content discovery, templates, image generation). However the runtime steps explicitly tell users/agents to execute a remote installer (curl https://cli.inference.sh | sh) and to run `infsh login` — both of which expand scope because they execute external code and may initiate credential flows not detailed in the skill.
!
Install Mechanism
There is no registry install spec, but SKILL.md instructs running a piped shell installer from https://cli.inference.sh which downloads a binary from dist.inference.sh. Download-and-pipe-to-sh is a high-risk pattern even if the doc claims SHA-256 verification is available; the installer behavior cannot be verified from the skill alone.
Credentials
The manifest declares no required env vars or credentials, which matches the skill text. But `infsh login` is part of the quick start and may prompt for service tokens/credentials at runtime — those credential requirements are not declared in the registry metadata and could grant broader access than the skill describes.
Persistence & Privilege
The skill is instruction-only, always:false, and does not request persistent platform privileges or modify other skills. The only persistence risk comes from installing the external infsh binary (writes to disk) and any credentials that infsh may store after login.
Scan Findings in Context
[no_regex_findings] expected: Scanner found no code files or regex hits. This is expected for an instruction-only skill, but it means there is no code in the package to inspect; risk comes from the external installer the SKILL.md instructs you to run.
What to consider before installing
This skill appears to do what it says (templates, sourcing queries, editorial guidance), but exercise caution before following its install steps. The SKILL.md recommends running a remote installer with curl | sh and then running `infsh login` — both can execute code on your machine and may request/store credentials. Before installing: 1) inspect the installer script (visit https://cli.inference.sh) instead of piping it straight to shell; verify the SHA-256 checksums from the stated source; 2) consider running the installer in a sandbox or VM; 3) be prepared that the CLI may ask for API keys or authorize services (which are not declared by the skill); only provide tokens with least privilege; 4) if you cannot or will not verify the installer, avoid running it and instead perform the content-sourcing steps manually with known tools. If you want higher assurance, ask the skill author for the exact installer script, its checksum, and documentation on what `infsh login` stores and where.

Like a lobster shell, security has layers — review code before you run it.

Current versionv0.1.5
Download zip
latestvk9723fex65qk1gmh5e0jpfqk2581chbn

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

SKILL.md

Newsletter Curation

Create and curate high-quality newsletters via inference.sh CLI.

Quick Start

curl -fsSL https://cli.inference.sh | sh && infsh login

# Find content to curate
infsh app run tavily/search-assistant --input '{
  "query": "most important AI developments this week 2024"
}'

# Generate newsletter header
infsh app run infsh/html-to-image --input '{
  "html": "<div style=\"width:600px;height:200px;background:linear-gradient(135deg,#1e293b,#334155);display:flex;align-items:center;padding:40px;font-family:system-ui;color:white\"><div><h1 style=\"font-size:32px;margin:0;font-weight:800\">The Weekly Signal</h1><p style=\"font-size:16px;opacity:0.7;margin-top:8px\">Issue #47 — January 15, 2025</p></div></div>"
}'

Install note: The install script only detects your OS/architecture, downloads the matching binary from dist.inference.sh, and verifies its SHA-256 checksum. No elevated permissions or background processes. Manual install & verification available.

Newsletter Formats

1. Link Roundup

5-15 curated links with 1-3 sentence commentary per link.

## This Week's Top Picks

### [Article Title](url)
One to three sentences explaining why this matters and what the
reader will get from it. Add your take — don't just describe.

### [Article Title](url)
Your commentary here. The value is your curation and perspective,
not just the link.

2. Deep Dive + Links

One in-depth analysis (300-500 words) + 5-8 curated links.

## The Big Story

[300-500 word analysis of the week's most important topic]

## Also Worth Reading

- **[Title](url)** — One sentence commentary
- **[Title](url)** — One sentence commentary
...

3. Original Essay

One focused piece (500-1,000 words) with a clear thesis.

## [Essay Title]

[Your original analysis, opinion, or insight]

## What I'm Reading

- [Title](url) — brief note
- [Title](url) — brief note

4. Q&A / Interview

Feature conversation with an expert or practitioner.

5. Data/Trends

Numbers, charts, and analysis of trends in your space.

Issue Structure

The Template

# [Newsletter Name] — Issue #[N]

## 👋 Hello

[2-3 sentences of personal intro — what's on your mind,
what this issue covers, why it matters right now]

## 🔥 The Big Story

[Featured content — your deepest analysis or most
important curated piece with commentary]

## 📚 Worth Reading

### [Title 1](url)
[2-3 sentence commentary with your take]

### [Title 2](url)
[2-3 sentence commentary]

### [Title 3](url)
[2-3 sentence commentary]

## 💡 Quick Hits

- [One-liner + link](url)
- [One-liner + link](url)
- [One-liner + link](url)

## 📊 Stat of the Week

[One compelling data point with context]

## 💬 From the Community

[Reader reply, question, or discussion point]

---

That's it for this week. If you found this useful, forward
it to a colleague who'd enjoy it.

[Your name]

Content Sourcing

Where to Find Content

# Industry news
infsh app run tavily/search-assistant --input '{
  "query": "[your niche] news this week latest developments"
}'

# Research and data
infsh app run exa/search --input '{
  "query": "[your niche] research report statistics 2024"
}'

# Trending discussions
infsh app run tavily/search-assistant --input '{
  "query": "site:reddit.com [your niche] discussion this week"
}'

# Academic/deep content
infsh app run exa/search --input '{
  "query": "[your niche] analysis deep dive opinion"
}'

Source Categories

Source TypeExamplesBest For
NewsTechCrunch, The Verge, industry pressBreaking developments
ResearchPapers, reports, surveysData-backed insights
BlogsEngineering blogs, personal blogsPractitioner perspectives
SocialTwitter threads, LinkedIn postsHot takes, discussions
ToolsProduct launches, updatesPractical recommendations
CommunityReddit, HN, forumsGround-level sentiment

Curation Quality Filter

For each piece of content, ask:

QuestionIf No →
Would I send this to a colleague 1-on-1?Don't include
Does it teach something actionable?Consider skipping
Is the source credible?Find better source
Is it timely/relevant this week?Save for later or skip
Can I add commentary that adds value?Just linking isn't enough

Writing Commentary

What Makes Good Commentary

❌ Just describing: "This article talks about React Server Components."
❌ Restating the headline: "React Server Components are here."

✅ Adding context: "React Server Components shipped last week, and this
   is the first production teardown I've seen. Key insight: they reduced
   initial JS bundle by 60%, but added complexity to the build pipeline."

✅ Giving your take: "I'm skeptical about the migration path here.
   Most teams I've talked to are waiting for better tooling."

✅ Connecting dots: "This pairs well with Vercel's announcement last
   month — the ecosystem is clearly converging on this pattern."

Commentary Formula

[What happened] + [Why it matters to the reader] + [Your take or prediction]

Sending Cadence

FrequencyBest ForOpen Rate Impact
WeeklyMost newslettersHighest — predictable, not overwhelming
Bi-weeklyDeep analysis, essaysGood if content is substantial
DailyNews-focused, short formatRequires dedicated habit, risky
MonthlyResearch roundupsOK for depth, risks being forgotten

Weekly is the sweet spot. Same day, same time, every week. Consistency builds habit.

DayPerformance
TuesdayHighest open rates
ThursdaySecond highest
WednesdayThird
MondayLower (inbox overload)
FridayLower (weekend mode)
WeekendLowest (but some niches thrive)

Subject Lines

FormulaExample
Issue number + teaser"#47: The framework nobody's talking about"
Number + topic"5 tools that changed my workflow this month"
Question"Is TypeScript dying?"
This week + category"This week in AI: GPT-5 rumors, open source wins"
Direct value"The SQL optimization guide I wish I had earlier"

Keep under 50 characters. Mobile truncates at ~35.

Growth Strategies

StrategyImplementation
Cross-promotionPartner with complementary newsletters
Social distributionPost key insights on Twitter/LinkedIn with subscribe CTA
Referral program"Forward to 3 friends" or formal referral rewards
SEO archivePublish newsletter archive as blog posts
Lead magnet"Subscribe and get [free resource]"
Consistent qualityThe best growth strategy: be worth reading
# Create social teaser for newsletter
infsh app run x/post-create --input '{
  "text": "This week in The Weekly Signal:\n\n→ Why edge computing is eating the backend\n→ The database migration nobody talks about\n→ 5 tools I discovered this month\n\nJoin 2,000+ engineers: [link]\n\nIssue #47 drops tomorrow morning."
}'

Metrics That Matter

MetricGoodGreatAction If Low
Open rate30-40%40%+Improve subject lines
Click rate3-5%5%+Better content curation, stronger CTAs
Unsubscribe rate< 0.5% per issue< 0.2%Check content quality, frequency
Reply rateAny repliesRegular repliesAsk questions, invite conversation
Forward rateAny forwardsMake content share-worthy
Growth rate5-10% monthly10%+Increase distribution, referral program

Common Mistakes

MistakeProblemFix
No consistent scheduleReaders forget about youSame day, same time, every week
Links without commentaryYou're a bookmark, not a newsletterAdd your take on every piece
Too many links (15+)Overwhelming, nothing stands out5-10 curated picks max
Generic subject linesLow open ratesTease the best content, keep under 50 chars
No personal voiceReads like an RSS feedIntro paragraph, opinions, personality
Only promotional contentReaders unsubscribe90% value, 10% promotion max
Inconsistent qualityTrust erodesSkip an issue rather than send a weak one
No CTA for engagementOne-way broadcastAsk questions, invite replies, encourage forwards
No archive/SEOMissing growth channelPublish issues as web pages

Related Skills

npx skills add inference-sh/skills@email-design
npx skills add inference-sh/skills@content-repurposing
npx skills add inference-sh/skills@seo-content-brief

Browse all apps: infsh app list

Files

1 total
Select a file
Select a file to preview.

Comments

Loading comments…