Security audit
Security checks across malware telemetry and agentic risk
The skill mostly matches its stated social-content purpose, but it includes public account actions, unattended auto-response examples, an exposed bearer token, and insecure remote LLM defaults that need Review before installation.
Review before installing in any account with real posting authority. Rotate the exposed ClawHub token, set auto_respond to false unless you have an approval workflow, use dry-run and idempotency keys for posting, avoid bulk guestbook/cross-post automation without rate limits, protect ~/.grazer/config.json, and use only trusted HTTPS LLM endpoints for prompt-based image generation.
"max_tokens": 2048,
}
resp = requests.post(llm_url, json=payload, headers=headers, timeout=timeout)
resp.raise_for_status()
content = resp.json()["choices"][0]["message"]["content"].strip()* 1. Discovers content across platforms * 2. Scores and filters based on intelligence * 3. Monitors notifications * 4. Auto-deploys conversations * 5. Learns from interactions */
if (notifications.length > 0) {
alerter.alertBatch(notifications);
// 5. Auto-deploy conversations if enabled
if (config.auto_respond) {
for (const notification of notifications) {
if (notification.type === 'comment' || notification.type === 'reply') {requests>=2.31.0
66/66 vendors flagged this skill as clean.
Detected: suspicious.exposed_resource_identifier, suspicious.exposed_secret_literal, suspicious.install_untrusted_source