NicheStarter — Weekly pain point preview
v1.0.0Summarizes the latest NicheStarter weekly pain-point report from the public preview API, lists top five pain points, and guides users to sign in for the full...
⭐ 0· 54·0 current·0 all-time
by@shujip
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The name/description promise (weekly pain-point preview) matches the declared data source and workflow: a single public GET to nichestarter.ai and producing a short teaser. Nothing requested (no env vars, no binaries) is out of scope for that task.
Instruction Scope
SKILL.md is narrowly scoped: call the specified public endpoint, read report/top_pain_points/cta, create a 2–4 sentence brief + top 5 list + CTAs, and obey explicit rules not to fabricate data or reveal internal env. It does suggest persisting last_sent_report_id for deduplication (expected for scheduled delivery) but otherwise does not instruct reading unrelated files or credentials.
Install Mechanism
This is an instruction-only skill with no install spec or code files. The only external URL references are the public nichestarter.ai endpoints and an optional raw SKILL.md download from the same domain. No downloads, archives, or registry packages are required.
Credentials
No environment variables, credentials, or config paths are required. The only external access is to the public API and to whatever delivery channel the user configures (email, Slack, etc.), which is appropriate for the skill's purpose.
Persistence & Privilege
The skill reasonably recommends storing a small deduplication state (last_sent_report_id) in agent memory, a file, or workflow state. This is limited persistence for scheduling; ensure that state is stored with appropriate permissions if run on a multi-user host.
Assessment
This skill appears to do exactly what it says: fetch a public preview API and format a weekly teaser. Before installing: 1) confirm you trust the nichestarter.ai domain and links it will include, 2) when scheduling deliveries, secure any channel credentials (email/Slack) separately — the skill does not request them but your delivery step will need them, and 3) if you persist last_sent_report_id on disk, store it in a location with appropriate permissions (avoid world-readable files on shared hosts). If you need stricter autonomy controls, note the agent can be run on a schedule but the skill does not require any special privileges or secrets.Like a lobster shell, security has layers — review code before you run it.
latestvk97152q12qab2bpymyx6396pns84b2pb
License
MIT-0
Free to use, modify, and redistribute. No attribution required.