Book Writer
Analysis
The skill appears aligned with its stated purpose of generating book content, but users should review its external API use, API key handling, and Python dependency installation.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
cmd = f"{sys.executable} -m pip install --upgrade {package}"The setup script installs or upgrades third-party Python packages from the package ecosystem. This is expected for the skill, but it changes the user's Python environment and depends on current package versions.
Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.
export OPENAI_API_KEY="your_openai_api_key" ... export GOOGLE_CSE_ID="your_google_cse_id" ... export GOOGLE_API_KEY="your_google_api_key"
The skill expects user-provided OpenAI and Google credentials for generation and material search. This is purpose-aligned and disclosed, but the registry metadata lists no required environment variables or primary credential.
Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.
messages=[{"role": "user", "content": outline_prompt}]The user's book prompt and generated outline instructions are sent to an external OpenAI chat completion API. This matches the skill's AI-writing purpose, but users should understand that manuscript topics or sensitive prompts leave the local environment.