Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

content-pipeline

Orchestrate full content workflow (planning→writing→design→publishing→tracking). Use when automating full content workflow from planning to publishing.

MIT-0 · Free to use, modify, and redistribute. No attribution required.
0 · 647 · 8 current installs · 8 all-time installs
MIT-0
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The skill claims to orchestrate a full content pipeline (planning→writing→design→publish→track), which is coherent in concept. However the SKILL.md shows CLI usage (content-pipeline --auto / --step ...) and references helper components (seo-content-planner, copywriting, cardnews, social-publisher) while the package declares no binaries, no install steps, and no provenance/homepage. It's unclear whether those components are separate skills, local binaries, or expected to already exist in the environment—this mismatch is an incoherence to resolve before trusting automation that can publish.
!
Instruction Scope
The instructions explicitly read and write files in a local events/ directory (e.g., events/seo-plan-YYYY-MM-DD.json, events/content-published-YYYY-MM-DD.json) and describe an --auto mode that will progress through stages and auto-publish to Instagram. Reading/writing local event files is within orchestration scope, but auto-publishing and file I/O without declared safeguards or explicit credential/config guidance increases risk and ambiguity (what publishes, with which account/credentials, and where are those stored?).
Install Mechanism
There is no install spec and no code files; the skill is instruction-only which is lowest-risk from an install perspective. However, the SKILL.md assumes external tooling/sub-skills that are not provided — the absence of an install mechanism contributes to the ambiguity rather than to code-install risk.
!
Credentials
The skill requests no environment variables or credentials in metadata, yet the documented behavior includes publishing to Instagram/SNS and tagging accounts. There is no guidance on required API keys, tokens, or where publishing credentials should be provided. That gap is problematic because automated publish actions will require credentials (or the agent may try to access existing environment secrets), so required secrets are not declared or scoped.
Persistence & Privilege
The skill does not request persistent presence (always: false) and does not declare modifications to other skills or system configuration. Autonomy (model invocation) is allowed by default, which is normal; this combined with the ability to auto-publish means you should be careful about enabling --auto without verifying credential boundaries, but there is no elevated platform-level privilege requested by the skill itself.
What to consider before installing
This is an instruction-only orchestration recipe that could be useful, but it is incomplete and ambiguous. Before installing or running: 1) Confirm where the referenced components (seo-content-planner, copywriting, cardnews, social-publisher) come from—are they separate skills, CLIs, or missing pieces you must provide? 2) Do not run --auto or --skip-review until you know which service/account will be used to publish; require explicit credential configuration for publishing tools (Instagram/Twitter API keys, OAuth tokens) stored in a dedicated, auditable location. 3) Inspect or sandbox the events/ directory the skill will read/write to ensure it does not contain sensitive data. 4) Prefer manual step execution first (use --step mode) to verify outputs and side effects. 5) Ask the author or vendor for a source/homepage, an install spec, and a list of required credentials and sub-skills; absence of that information increases risk. If you cannot verify these points, treat the skill as untrusted for automated publishing.

Like a lobster shell, security has layers — review code before you run it.

Current versionv1.0.1
Download zip
latestvk97fczkg26v74g7p4shazbrq3s819eh2

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

SKILL.md

content-pipeline

Meta skill orchestrating the entire content production flow.

Pipeline Stages

1. seo-content-planner → Keyword analysis & content planning
2. copywriting → Write body text
3. cardnews → Generate card news images
4. social-publisher → Publish to Instagram/SNS
5. Performance tracking → Feedback via daily report

Usage

Full Auto-execution

content-pipeline --auto --topic "Photobooth usage tips"

Individual Stage Execution

# Stage 1: Planning
content-pipeline --step plan --topic "Photobooth trends"

# Stage 2: Write body (auto-loads previous stage event)
content-pipeline --step write

# Stage 3: Generate card news
content-pipeline --step design

# Stage 4: Publish
content-pipeline --step publish

# Stage 5: Check performance
content-pipeline --step track

Event Integration

Each stage automatically reads previous stage results from events/ directory:

  • seo-plan-YYYY-MM-DD.json → copywriting input
  • content-draft-YYYY-MM-DD.json → cardnews input
  • content-published-YYYY-MM-DD.json → daily-report input

Options

  • --auto — Auto-execute all stages
  • --step <plan|write|design|publish|track> — Execute specific stage only
  • --topic <topic> — Specify content topic
  • --skip-review — Proceed without approval at each stage (risky)

Execution Flow

Auto Mode (--auto)

  1. Execute seo-content-planner → Generate events/seo-plan-YYYY-MM-DD.json
  2. Execute copywriting with generated keywords/topic → Generate events/content-draft-YYYY-MM-DD.json
  3. Generate cardnews based on draft → Generate events/cardnews-ready-YYYY-MM-DD.json
  4. Execute social-publisher with images + caption → Generate events/content-published-YYYY-MM-DD.json
  5. Auto-include publishing results in daily-report

Stage-by-stage Mode (--step)

Request approval at each stage:

  • Review plan → approve → next
  • Review draft → approve → next
  • Preview card news → approve → publish

Examples

Generate Photobooth Tips Content

content-pipeline --auto --topic "Preserving wedding memories with photobooths"

Result:

  • SEO keywords: "wedding photobooth", "wedding photo booth", etc.
  • Blog draft 1200 chars
  • Card news 5 slides (1024x1024 square)
  • Auto-publish to Instagram (tag collaboration account)
  • Include publishing results in daily report

Manual Verification by Stage

# 1. Review plan first
content-pipeline --step plan --topic "University festival photobooths"
# → Generate events/seo-plan-2026-02-14.json

# 2. Write draft after reviewing plan
content-pipeline --step write
# → Generate events/content-draft-2026-02-14.json

# 3. Design after reviewing draft
content-pipeline --step design
# → Generate 5 card news slides

# 4. Publish after final review
content-pipeline --step publish

Cautions

  • --auto mode proceeds automatically through stages, so always verify content before final publish
  • Images must be JPG format (PNG may cause Instagram errors)
  • After publishing, events/content-published-YYYY-MM-DD.json automatically collected by daily-report

Implementation Guide

As this is a meta skill, during actual implementation:

  1. Check events/seo-plan-*.json → load if exists
  2. If not exists, execute seo-content-planner
  3. Pass results as input to next skill
  4. Generate event file at each stage

Author: 무펭이 🐧
Created: 2026-02-14
Status: Production Ready

Files

1 total
Select a file
Select a file to preview.

Comments

Loading comments…