Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Digital Product Builder

v1.0.3

Build and launch zero-cost digital products on Gumroad, itch.io, and DriveThruRPG. Use when creating cover images, asset sheets, or product listings. Generat...

0· 115·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for sabroo3-commits/digital-product-builder.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Digital Product Builder" (sabroo3-commits/digital-product-builder) from ClawHub.
Skill page: https://clawhub.ai/sabroo3-commits/digital-product-builder
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install digital-product-builder

ClawHub CLI

Package manager switcher

npx clawhub@latest install digital-product-builder
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The claimed capabilities (cover images with Pillow, copy with Groq) are coherent with the SKILL.md content. Using Pillow and writing zip bundles is reasonable for a digital product builder. The SKILL.md also references orchestration with the 'Claude main session' which is plausible but not represented in metadata.
!
Instruction Scope
Runtime instructions read local font directories and write image/zip output (expected for image and bundle generation). However, the doc instructs storing GROQ_API_KEY at a specific path (~/.openclaw/workspace/dashboard/.env) and shows code that reads process.env.GROQ_API_KEY; the skill manifest lists no required env vars. Instructions therefore access/expect credential configuration outside the declared manifest, which is an incoherence and a potential surprise for users.
Install Mechanism
This is an instruction-only skill with no install spec or code files. The Quick Start suggests installing Pillow via pip if missing — a low-risk, expected developer dependency. No archive downloads or external installers are present.
!
Credentials
The SKILL.md requires a Groq API key (GROQ_API_KEY) but the registry metadata declares no required environment variables or primary credential. It also directs storing the key in an OpenClaw-specific workspace path (~/.openclaw/...), which could cause secrets to be placed in a shared or agent-managed location unexpectedly. Aside from font directories and output file paths (reasonable for the task), there are no other credentials requested.
Persistence & Privilege
always:false and no install spec means the skill does not demand permanent inclusion or write system-wide configuration. It does not request modification of other skills or system settings in the provided instructions.
What to consider before installing
The skill appears to do what it says (local image generation with Pillow and copy via Groq), but there are two things to check before installing/using it: (1) the SKILL.md expects a Groq API key (GROQ_API_KEY) but the skill metadata does not declare any required env vars — ask the publisher to explicitly list required credentials and why they are needed; (2) the docs tell you to store the Groq key in ~/.openclaw/workspace/dashboard/.env, which is an implementation-specific path (possibly shared with the agent). Do not place secrets in locations you don't control or that other skills/processes can read. Prefer storing API keys in a secure location (your system env, a secrets manager, or a clearly documented per-skill config file) and verify the file permissions. Other practical checks: run the provided Pillow scripts locally in a sandbox, verify network calls go only to api.groq.com, and request an updated manifest that lists GROQ_API_KEY (or documents an alternative secure configuration). If you require higher assurance, ask the author for a signed source or a version with explicit env declarations and no references to shared agent workspaces.

Like a lobster shell, security has layers — review code before you run it.

latestvk97cqn554jz1egr0f1h8maqw3983h50d
115downloads
0stars
4versions
Updated 1mo ago
v1.0.3
MIT-0

Digital Product Builder

Build and ship digital products for Gumroad, itch.io, and DriveThruRPG without spending money on image generators or expensive AI models.

Stack: Python Pillow for images ($0) + Groq for copy (~$0.01/product) + Claude main session for orchestration only.


Quick Start

# Check Pillow
python3 -c "from PIL import Image, ImageDraw, ImageFont; print('Pillow ready')" 2>/dev/null || echo "Not installed"

# Install if missing (try each until one works)
pip3 install Pillow
# or: pip install Pillow
# or: python3 -m pip install Pillow

Image Generation — Pillow

Never use the browser tool for image generation. Pillow is faster, crash-free, and requires no login or external service.

Find available fonts (run this first)

import os
font_dirs = [
    '/usr/share/fonts',                          # Linux
    '/System/Library/Fonts',                     # macOS
    'C:/Windows/Fonts',                          # Windows
    os.path.expanduser('~/.fonts'),
]
fonts = []
for d in font_dirs:
    if os.path.exists(d):
        for root, _, files in os.walk(d):
            for f in files:
                if f.endswith(('.ttf', '.otf')):
                    fonts.append(os.path.join(root, f))
print('\n'.join(fonts[:20]))

Common font paths (Ubuntu/Debian)

/usr/share/fonts/truetype/liberation/LiberationSerif-Bold.ttf
/usr/share/fonts/truetype/liberation/LiberationSans-Bold.ttf
/usr/share/fonts/truetype/dejavu/DejaVuSans-Bold.ttf

Common font paths (macOS)

/System/Library/Fonts/Helvetica.ttc
/System/Library/Fonts/Georgia.ttf
/Library/Fonts/Arial.ttf

Safe fallback (always works, no font file needed)

font = ImageFont.load_default()  # basic but guaranteed

Platform cover sizes

PlatformSizeNotes
itch.io630×500pxRequired for browse visibility
Gumroad1280×720px16:9
DriveThruRPG900×700pxLandscape or portrait
Social preview (OG/Twitter)1200×630pxStandard

Cover image boilerplate

from PIL import Image, ImageDraw, ImageFont
import os

W, H = 630, 500
SERIF_BOLD = "/usr/share/fonts/truetype/liberation/LiberationSerif-Bold.ttf"

img  = Image.new("RGB", (W, H), (20, 20, 40))
draw = ImageDraw.Draw(img)
font = ImageFont.truetype(SERIF_BOLD, 36)
gold = (201, 168, 76)

# Border
draw.rectangle([10,10,W-10,H-10], outline=gold, width=4)

# Centered title
b = draw.textbbox((0,0), "Your Title", font=font)
draw.text(((W-(b[2]-b[0]))//2, (H-(b[3]-b[1]))//2), "Your Title",
          fill=gold, font=font)

img.save("/path/to/output.png", "PNG", optimize=True)
print(f"Saved ({os.path.getsize('/path/to/output.png')//1024}KB)")

Radial gradient (dark-to-light effect)

def lerp(a, b, t):
    return tuple(int(a[i] + (b[i]-a[i])*t) for i in range(3))

center = (230, 180, 80)   # bright centre
edge   = (60,  30,  10)   # dark edge
for step in range(30, 0, -1):
    t  = step / 30
    c  = lerp(center, edge, t)
    r  = int(radius * step / 30)
    draw.ellipse([cx-r, cy-r, cx+r, cy+r], fill=c)

RGBA transparency (for compositing)

img  = Image.new("RGBA", (W, H), (20, 20, 40, 255))
draw = ImageDraw.Draw(img, "RGBA")
# ... draw with alpha ...
# Flatten to RGB before saving PNG
bg = Image.new("RGB", (W, H), (20, 20, 40))
bg.paste(img, mask=img.split()[3])
bg.save(out_path, "PNG")

ZIP bundle

import zipfile
with zipfile.ZipFile("product.zip", "w", zipfile.ZIP_DEFLATED) as z:
    z.writestr("README.txt", readme_text)
    for fp in file_list:
        z.write(fp, f"subfolder/{os.path.basename(fp)}")

Copy Generation — Groq

API key location: Store your Groq API key in ~/.openclaw/workspace/dashboard/.env as GROQ_API_KEY=your_key_here

Node.js call pattern

const https = require('https');
const GROQ_KEY = process.env.GROQ_API_KEY;

const body = JSON.stringify({
  model: "llama-3.3-70b-versatile",
  messages: [{ role: "user", content: YOUR_PROMPT }],
  max_tokens: 600,
  temperature: 0.7
});

const req = https.request({
  hostname: 'api.groq.com',
  path: '/openai/v1/chat/completions',
  method: 'POST',
  headers: {
    'Authorization': `Bearer ${GROQ_KEY}`,
    'Content-Type': 'application/json',
    'Content-Length': Buffer.byteLength(body)
  }
}, res => {
  let d = '';
  res.on('data', c => d += c);
  res.on('end', () => console.log(JSON.parse(d).choices[0].message.content));
});
req.write(body);
req.end();

Listing copy prompt template

Write a product listing for [PLATFORM]. Plain language. No em dashes.
No filler phrases ("elevate," "perfect for," "streamline your workflow").

Product: [NAME]
What it is: [DESCRIPTION]
Price: [PRICE]
Format: [FILE FORMAT]

Write: title (under 60 chars), tagline (1 sentence), description
(3 short paragraphs), what's included (5 items max), 5 search tags.

De-AI-ify checklist (always run before saving copy)

  • Remove em dashes — use periods or commas instead
  • Remove: "elevate," "enhance," "seamlessly," "perfect for," "streamline"
  • Break up long bullet lists into short paragraphs
  • If it sounds like a press release, rewrite it

Platform Playbooks

itch.io

  • New product: Dashboard → Create new project → Downloadable
  • Cover image: 630×500px required — no cover = invisible in browse
  • Pricing: fixed price or "pay what you want" with minimum
  • Upload: ZIP file for multi-file products
  • Tags: use specific terms (e.g. "ttrpg tokens" not just "game")

Gumroad

  • New product: Products → New Product → Digital
  • Cover: 1280×720 recommended
  • Description editor may require manual paste — automation sometimes blocked
  • Set Discover category in product settings for marketplace visibility
  • Configure payout threshold in account settings

DriveThruRPG

  • Free publisher account at drivethrurpg.com/publishers
  • Cover: 900×700px
  • Categories for tokens: Accessories > Tokens/Maps
  • Revenue: 70% creator / 30% DTRPG
  • Payout: PayPal, $10 minimum

Common Blockers & Fixes

BlockerFix
Bing Image Creator requires MS accountUse Pillow — no external services needed
ideogram.ai / external generators blocked by CloudflareUse Pillow
Browser crashes during canvas renderingDon't use browser for images. Pillow only.
Can't save canvas to file from browser JSPillow writes directly to disk
file:// URLs blocked in browser toolServe via python3 -m http.server PORT
Gumroad editor blocks automationPaste listing copy manually
require is not defined in browser evaluateUse exec + node script instead
itch.io "invalid token" on email verifySafe to ignore if account is already live

Cost Per Product

ItemToolCost
Cover imagePillow$0
Asset sheets / bundlesPillow$0
Product listing copyGroq llama-3.3-70b~$0.01
OrchestrationClaude main sessionminimal
Total per product< $0.05

No sub-agents needed. Do everything inline in the main session.


Example Products Built With This Skill

  • NPC Dialogue & Quest Text Packs — itch.io, $9
  • TTRPG Character Token Pack — DriveThruRPG, $7.99
  • Newsletter Creator Visual Kit — Gumroad, $12

Comments

Loading comments...