Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Content Summary

v1.0.0

Short alias for content-search-summarization. Use this to search public content platforms, rank the top relevant items, and summarize them with links.

0· 212·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for allens0104/content-summary.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Content Summary" (allens0104/content-summary) from ClawHub.
Skill page: https://clawhub.ai/allens0104/content-summary
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install content-summary

ClawHub CLI

Package manager switcher

npx clawhub@latest install content-summary
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description match the instructions: search public platforms, rank results, and summarize with links. That purpose is reasonable and aligns with the guidance in SKILL.md.
Instruction Scope
Instructions stay focused on public content and require capturing metadata and links. However the fallback instructs using Playwright to scrape result pages; that enables browser automation and arbitrary page access (potentially including interactive elements or pages that require authentication) even though the skill is supposed to target public pages only. The SKILL.md does include conservative summary rules, which is good, but it gives an agent power to open web pages without specifying limits (rate limits, login avoidance, or data handling rules).
Install Mechanism
There is no install spec (instruction-only), which minimizes footprint. But the document explicitly recommends 'opencli' and Playwright as runtime tools; those are not declared as required binaries or installed by the skill, creating an operational mismatch: the agent may need to install or have these tools available to implement the skill.
!
Credentials
The skill declares no required environment variables or credentials, yet it prefers 'opencli' (which for some platforms may require API keys) and falls back to Playwright scraping (which can access any public page and potentially sensitive data exposed in the browser context). The lack of declared API credentials or guidance about avoiding authenticated scraping is an incoherence and a potential risk.
Persistence & Privilege
The skill does not request persistent/always-on presence, does not modify configs, and is user-invocable only. No elevated persistence privileges are requested.
What to consider before installing
This skill appears to do what it says (search and summarize public content), but the runtime instructions mention tools (opencli, Playwright) that may require installation or API credentials that the skill does not declare. Before installing or enabling it: 1) confirm whether your agent environment already has opencli and/or Playwright and whether they require API keys (e.g., YouTube API) — if so, only provide credentials you trust and understand; 2) decide whether you want the agent to perform headless browser scraping (Playwright) — scraping can accidentally access interactive or authenticated content and increase privacy risk; 3) set clear limits (rate limits, avoid logins, and do not capture cookies or local data) if you let it run; and 4) monitor any prompts the agent makes to install tools or request secrets. If you need a fully auditable behavior, request an explicit install spec and declared environment variables from the skill author before enabling.

Like a lobster shell, security has layers — review code before you run it.

latestvk97abq3w4abyggqaqry4fmz8ds845bnv
212downloads
0stars
1versions
Updated 3w ago
v1.0.0
MIT-0

Content summary skill

This is the short public alias for:

  • content-search-summarization

Also available as simpler aliases:

  • summary
  • 内容摘要

Use this skill when you want to:

  • search Bilibili, YouTube, or similar public content platforms
  • pick the top N relevant results for a topic
  • summarize each item in Chinese with links

Primary guidance

  1. Prefer opencli for supported platforms.
  2. If opencli is unavailable, fall back to Playwright scraping of public result pages.
  3. Rank by relevance first, popularity second.
  4. Open selected result pages and use metadata to improve summaries.
  5. Use a structured output with source, capture time, link, summary, and confidence.

Key rules

  • Always include source links.
  • Include capture time or say when the timestamp is not visible.
  • Do not pretend a full video was watched if only metadata was collected.
  • Phrase summaries conservatively when based on public page metadata.
  • Add a confidence label and a short caveat when the summary is metadata-based.

Quick invocation template

You do not need to use only /content-summary.

Reliable invocation patterns include:

  1. /content-summary
  2. use the content-summary skill
  3. a natural-language request that clearly asks for content search, ranking, and summary output

Use prompts like:

Use /content-summary to find the top 5 results for <topic> on <platform> and summarize each item with links and confidence labels.
使用 /content-summary 在 <平台> 搜索 <主题>,筛选 Top 5,并输出带链接与置信度的摘要。
Please find the top results for <topic> on <platform>, rank them by relevance, and summarize each item with links and confidence notes.

Output contract

The skill output should always include:

  1. search method used (opencli or fallback)
  2. keyword and capture scope
  3. ranked results with links
  4. per-item confidence and caveat
  5. explicit note when summaries are metadata-inferred

Pointer

For the full detailed playbook, also see:

  • skills/content-search-summarization/SKILL.md in this repository

Comments

Loading comments...