ClawHub

Turn quotes and reflections from books or films into polished shareable check-in posters.

v1.0.3

Say "Help me install the ClawHub skill quote-checkin-poster" to your local agent, then create shareable quote and reflection posters.

⭐ 0· 37·0 current·0 all-time
byliuliu026@shuminliu026·duplicate of @shuminliu026/quote-check-in-poster
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
Requires sensitive credentials
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
medium confidence
✓
Purpose & Capability
The skill's name and description (create shareable quote/check-in posters) align with the SKILL.md: it calls image-process and design-generate endpoints on a third-party service (mew.design). Requesting a mew.design API key from the user is coherent with that purpose. There are no unrelated credentials, binaries, or install steps requested.
ℹ
Instruction Scope
Instructions remain within the poster-generation workflow (collect inputs, validate/reuse mew.design API key, call image and design APIs, iterate on results). One notable scope decision: if the user only has a local image, the skill says it can 'temporarily upload the image to a third-party file host' to obtain a public URL, but does not name the host or provide constraints. That introduces a privacy/exfiltration risk unless the agent asks for explicit consent and names the host before uploading (the skill text does say to ask for consent).
✓
Install Mechanism
Instruction-only skill with no install spec or code files — nothing is written to disk or downloaded. This is the lowest-risk install mechanism and matches the declared metadata.
✓
Credentials
No environment variables or system credentials are requested. The only secret the skill needs is a mew.design API key which it expects the user to provide in the conversation; that is proportionate to calling the external image/design APIs. The skill does not request unrelated credentials.
✓
Persistence & Privilege
always is false and disable-model-invocation is false (normal). The skill does not request persistent system privileges or modify other skills' settings. It instructs the agent to reuse a mew.design key 'in the current conversation' which is routine behavior and not a system-wide persistence request.
Assessment
This skill appears to be what it says: it will ask you for a mew.design API key and use mew.design's image/design APIs to produce posters. Before installing or using it: 1) Only paste your mew.design API key into a private conversation channel you trust. 2) Prefer creating a scoped or temporary API key on mew.design (if possible) and revoke it later. 3) If you supply local images, ask the agent which third‑party file host it will use for temporary uploads — avoid uploading private or sensitive images to unknown hosts. 4) Confirm the agent explicitly asks for consent before any upload and names the destination. 5) If you have concerns about privacy, consider hosting the image on a trusted URL yourself (or providing only public assets) rather than allowing the skill to upload them.

Like a lobster shell, security has layers — review code before you run it.

latestvk974px0gryksbfqrf755j760wd84wtaz

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments