Reddit Quote Carousel
WarnAudited by ClawScan on May 10, 2026.
Overview
The skill’s carousel goal is coherent, but it would publish to Instagram and use repo/account access without clearly declaring credentials, scope, or a final approval step.
Before installing, confirm which Instagram account and repo this can access, review the referenced helper skills/scripts, and require a manual preview and approval before anything is published or cleaned up.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The agent could publish an incorrect or unauthorized carousel and remove hosted/local working files without the user explicitly approving the final content.
This directs the agent to perform repo hosting, Instagram publishing, and cleanup as the default workflow, but the artifact does not show a final human approval step, account/repo scope, or rollback control before mutation.
### Sub-agent 3: Publish to Instagram Same as `create-instagram-carousel-post` Sub-agent 3: 1. Host images in tabiji repo (`img/instagram/`) 2. Create carousel item containers 3. Create carousel container with caption 4. Publish 5. Cleanup hosted images + local temp files
Require an explicit preview-and-approve step before publishing, declare the target Instagram account and repo path, and make cleanup a separately confirmed action.
The skill may rely on whatever Instagram, GitHub/repo, or local session credentials are already available to the agent, which could affect the wrong account or workspace.
The declared credential/config contract is empty, while SKILL.md instructs publishing to Instagram and hosting in a repo. Those actions normally require account or repository credentials, so the artifacts do not bound which ambient credentials or accounts may be used.
Required env vars: none Env var declarations: none Primary credential: none Required config paths: none
Declare the required credentials and scopes, require the user to select the account/repo, and document exactly what permissions are needed.
Important behavior, including public posting, depends on other local skills or scripts whose code and permissions were not reviewed here.
The reviewed package contains only this instruction file, but it delegates photo selection, image processing, and publishing to external workflows/skills that are not included or pinned in the artifact set.
Find photos using `instagram-photo-find` workflow ... Create overlays using `instagram-photo-text-overlay` skill ... Same as `create-instagram-carousel-post` Sub-agent 3
List these as explicit dependencies with versions or sources, include their reviewed implementation or links, and require users to review/install them before enabling publishing.
Image generation depends on local code that may not exist or may behave differently on the user’s machine.
The skill instructs the agent to run a local Python helper by absolute path. This is related to the image-overlay purpose, but the helper is outside the reviewed skill package.
python3 /Users/psy/.openclaw/workspace/skills/instagram-photo-text-overlay/scripts/overlay.py \
Use a packaged or declared helper path and ensure users can review the script before it is run.