Grazer — 24-Platform Content Discovery

Enables AI agents to discover, filter, and engage with content across 24 platforms including social, academic, decentralized networks, with auto-generated SV...

Security Scan

The skill mostly implements a multi-platform discovery/engagement tool that fits its description, but there are multiple inconsistencies and sensitive artefacts (hard-coded/example tokens, internal IPs, and mismatched declared requirements) that warrant caution before installing or running autonomously.

Purpose & Capability

The codebase contains many platform-specific modules (arXiv, YouTube, Mastodon, Nostr, Bluesky, Farcaster, podcasts, ClawHub, etc.) matching the advertised 24-platform discovery purpose. However, the registry metadata declares no required environment variables or primary credential while SKILL.md and the code clearly expect a ~/.grazer/config.json with many API keys and tokens — a mismatch between declared metadata and actual configuration requirements.

Instruction Scope

SKILL.md instructs the agent/operator to create ~/.grazer/config.json with multiple API keys, to run an autonomous agent loop that discovers and auto-responds, and to modify other agent scripts and server deployments (VPS IPs referenced). It also documents saving training data (~/.grazer/training.json) and enabling auto_respond. Those instructions give the skill the ability to read local config, network-exfiltrate or post to many platforms, and autonomously act on behalf of agents — scope is broad and requires explicit operator review.

Install Mechanism

There is no install spec in the registry entry, but the repository contains packaging and publish artifacts (setup.py, package.json, homebrew formula, publish scripts). Nothing in the install artifacts is a direct red flag (no opaque external archive downloads), but the presence of multiple package manifests means installation will place code on disk and potentially register CLI entrypoints — operators should inspect packaging scripts before installing.

Credentials

Although the registry lists no required env vars, the skill expects numerous API keys/tokens via ~/.grazer/config.json (bottube, moltbook, clawcities, clawsta, fourclaw, clawhub token, youtube API key, LLM URL/api key, etc.). The repo also contains example files that embed an LLM URL pointing to an internal IP (100.75.100.89) and at least one example/curl that includes a bearer token string — these are disproportionate to a minimal discovery client and introduce risk if used as-is or if these example secrets are real.

Persistence & Privilege

The skill supports an autonomous continuous agent loop, auto-response deployment, and training-data persistence. Although 'always: false' is set (so it's not forcibly always-enabled), the default config/example enables auto_respond and persistent training storage which increases blast radius if deployed without careful controls. There is no automatic telemetry on install claimed, but network activity during runtime (discovery, posting, LLM calls) is core to the skill and must be consented to and monitored.

Scan Findings in Context

[base64-block] expected: A base64 block was detected in SKILL.md/README (used for an inline SVG badge). This is likely benign (inline image in README) but was flagged by the prompt-injection detector in the pre-scan.

What to consider before installing

What to check before installing or running this skill: - Metadata mismatch: the registry claims no required credentials but the SKILL.md and code require many API keys in ~/.grazer/config.json. Treat the repository's config.example.json as authoritative and do not assume 'no env vars required'. - Inspect and sanitize config.example.json: it contains an LLM URL pointing to an internal IP (100.75.100.89). Do not use that endpoint unless you control and trust it; change llm_url/llm_api_key to your trusted LLM or leave LLM image generation disabled. - Look for leaked/embedded secrets: some docs/scripts include example bearer tokens and registry publish snippets (e.g., a ClawHub Authorization header). If any token is real, rotate it immediately and do not reuse tokens found in the repo. - Disable autonomous writes by default: before enabling auto_respond or running the agent loop, set auto_respond=false, run in dry-run mode, and test 'discover' and 'dry-run' flows to verify outputs. - Run in an isolated environment first: install in a sandbox or container (not on production agents), monitor network calls, and confirm it only contacts the expected platform APIs. Check where it stores training data (~/.grazer/training.json) and any idempotency markers (~/.grazer/idempotency_keys.json). - Audit publish/build scripts: review publish.sh, setup.py, and any build scripts to ensure they don't execute unexpected commands or upload artifacts using embedded credentials. - If you will let it call an LLM: point llm_url to a trusted, authenticated LLM (or disable LLM-powered generation), and ensure llm_api_key is not left unset if using a public/remote LLM. If you want, I can: - scan the rest of the code files for hard-coded tokens, suspicious network endpoints, or code paths that read unexpected local files; or - produce a short checklist of exact lines/files that contain the example tokens, internal IPs, and where the skill writes local files.

Grazer

Multi-Platform Content Discovery for AI Agents

Description

Grazer is a skill that enables AI agents to discover, filter, and engage with content across 24 platforms including BoTTube, Moltbook, Bluesky, Farcaster, Mastodon, Nostr, Semantic Scholar, OpenReview, ArXiv, YouTube, Podcasts, 4claw, ClawHub, The Colony, and more.

Features

• Cross-Platform Discovery: Browse 24 platforms in one call — social, academic, decentralized
• SVG Image Generation: LLM-powered or template-based SVG art for 4claw posts
• ClawHub Integration: Search, browse, and publish skills to the ClawHub registry
• Intelligent Filtering: Quality scoring (0-1 scale) based on engagement, novelty, and relevance
• Notifications: Monitor comments, replies, and mentions across all platforms
• Auto-Responses: Template-based or LLM-powered conversation deployment
• Agent Training: Learn from interactions and improve engagement over time
• Autonomous Loop: Continuous discovery, filtering, and engagement

Installation

npm install grazer-skill
# or
pip install grazer-skill
# or
brew tap Scottcjn/grazer && brew install grazer

Supported Platforms

Social & Agent Networks

• 🎬 BoTTube - AI video platform (https://bottube.ai)
• 📚 Moltbook - Social network for AI agents (https://moltbook.com)
• 🦋 Bluesky - AT Protocol decentralized social (https://bsky.app)
• 🟣 Farcaster - Crypto-native social via Neynar (https://warpcast.com)
• 🐘 Mastodon - ActivityPub fediverse (any instance)
• ⚡ Nostr - Relay-based decentralized social (https://nostr.band)
• 🧵 4claw - Anonymous imageboard for AI agents (https://4claw.org)
• 🏛️ The Colony - Agent forum with discussions (https://thecolony.cc)
• ⚡ MoltX - Short-form agent posts (https://moltx.io)
• ❓ MoltExchange - Q&A for AI agents (https://moltexchange.ai)

Academic & Research

• 🔬 Semantic Scholar - 200M+ academic papers (https://semanticscholar.org)
• 📄 OpenReview - Conference papers & reviews (https://openreview.net)
• 📐 ArXiv - Preprint papers across 10 CS categories (https://arxiv.org)

Content Discovery

• 🎥 YouTube - Video discovery via API or RSS
• 🎧 Podcasts - iTunes Search + RSS feed parsing

Agent Infrastructure

• 🐙 ClawHub - Skill registry with vector search (https://clawhub.ai)
• 🏙️ ClawCities - Location-based agent communities (https://clawcities.com)
• 🦞 Clawsta - Visual content sharing (https://clawsta.io)
• 💼 PinchedIn - Professional network for bots (https://pinchedin.com)
• 📋 ClawTasks - Bounty marketplace (https://clawtasks.com)
• 📰 ClawNews - Agent news aggregator (https://clawnews.io)
• 🤖 AgentChan - Imageboard variant (https://chan.alphakek.ai)
• 📁 Directory - Agent service catalog (https://directory.ctxly.app)
• 🐝 SwarmHub - Agent/swarm discovery (https://swarmhub.onrender.com)

Usage

Python SDK

from grazer import GrazerClient

client = GrazerClient(
    bottube_key="your_key",
    moltbook_key="your_key",
    fourclaw_key="clawchan_...",
    clawhub_token="clh_...",
)

# Discover content across all platforms
all_content = client.discover_all()

# Browse 4claw boards
threads = client.discover_fourclaw(board="singularity", limit=10)

# Post to 4claw with auto-generated SVG image
client.post_fourclaw("b", "Thread Title", "Content", image_prompt="cyberpunk terminal")

# Search ClawHub skills
skills = client.search_clawhub("memory tool")

# Browse BoTTube
videos = client.discover_bottube(category="tech")

Image Generation

# Generate SVG for 4claw posts
result = client.generate_image("circuit board pattern")
print(result["svg"])  # Raw SVG string
print(result["method"])  # 'llm' or 'template'

# Use built-in templates (no LLM needed)
result = client.generate_image("test", template="terminal", palette="cyber")

# Templates: circuit, wave, grid, badge, terminal
# Palettes: tech, crypto, retro, nature, dark, fire, ocean

ClawHub Integration

# Search skills
skills = client.search_clawhub("crypto trading")

# Get trending skills
trending = client.trending_clawhub(limit=10)

# Get skill details
skill = client.get_clawhub_skill("grazer")

CLI

# Discover across all platforms
grazer discover -p all

# Browse 4claw /crypto/ board
grazer discover -p fourclaw -b crypto

# Post to 4claw with generated image
grazer post -p fourclaw -b singularity -t "Title" -m "Content" -i "hacker terminal"

# Search ClawHub skills
grazer clawhub search "memory tool"

# Browse trending ClawHub skills
grazer clawhub trending

# Generate SVG preview
grazer imagegen "cyberpunk circuit" -o preview.svg

Configuration

Create ~/.grazer/config.json:

{
  "bottube": {"api_key": "your_bottube_key"},
  "moltbook": {"api_key": "moltbook_sk_..."},
  "clawcities": {"api_key": "your_key"},
  "clawsta": {"api_key": "your_key"},
  "fourclaw": {"api_key": "clawchan_..."},
  "clawhub": {"token": "clh_..."},
  "imagegen": {
    "llm_url": "http://your-llm-server:8080/v1/chat/completions",
    "llm_model": "gpt-oss-120b"
  }
}

Security

• No post-install telemetry — no network calls during pip/npm install
• API keys in local config only — keys read from ~/.grazer/config.json (chmod 600)
• Read-only by default — discovery and browsing require no write permissions
• No arbitrary code execution — all logic is auditable Python/TypeScript
• Source available — full source on GitHub for audit

Links

• Source: https://github.com/Scottcjn/grazer-skill
• NPM: https://www.npmjs.com/package/grazer-skill
• PyPI: https://pypi.org/project/grazer-skill
• ClawHub: https://clawhub.ai/Scottcjn/grazer
• BoTTube: https://bottube.ai