Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Indie App Marketing Pipeline

v1.0.0

Template-driven multi-platform content pipeline for indie iOS developers. Generates and schedules a full week of social posts (TikTok, YouTube Shorts, X/Twit...

0· 107·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for zakmcintyre/indie-app-marketing-pipeline.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Indie App Marketing Pipeline" (zakmcintyre/indie-app-marketing-pipeline) from ClawHub.
Skill page: https://clawhub.ai/zakmcintyre/indie-app-marketing-pipeline
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required env vars: POSTIZ_API_KEY
Required binaries: node
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install indie-app-marketing-pipeline

ClawHub CLI

Package manager switcher

npx clawhub@latest install indie-app-marketing-pipeline
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
The skill claims to schedule social posts via Postiz and requires node + POSTIZ_API_KEY — exactly what the scripts use. Required files, prompts, and integration IDs all match the marketing/scheduling purpose.
Instruction Scope
SKILL.md and the scripts explicitly instruct the agent/user to create a local directory, configure Postiz integration IDs, edit a content bank, run the weekly planner and daily publisher, and optionally run a video-gen script. The scripts read local files (.env, config.json, content-bank.json, posting-history.json) and call Postiz — all within the described scope. No hidden network endpoints or extra data-collection steps are present.
Install Mechanism
There is no remote install or arbitrary downloader. This is an instruction+script package with no install spec; files are bundled in the skill. That lowers supply-chain risk compared with remote downloads.
Credentials
Only POSTIZ_API_KEY (and user-provided integration IDs stored in config) are required. That is proportional to scheduling posts via Postiz. The scripts read .env and config.json as expected and do not attempt to access unrelated credentials or system config paths.
Persistence & Privilege
always is false and the skill does not request persistent platform-wide privileges. setup.sh writes files into the chosen target directory (config.json, .env, posting-history.json) — confined to the user's chosen workspace and expected for this functionality.
Assessment
This package appears to do what it says: generate plans from a local content bank and post them to Postiz. Before installing/runing: 1) Review config.json/.env values and keep your POSTIZ_API_KEY secret; setup.sh writes the API key in plaintext to .env. 2) Run weekly-planner.js and daily-publisher.js with --dry-run first to confirm outputs and that findPlanForDate picks the expected plan. 3) The publisher will make live API calls unless you use --dry-run — only run live when ready. 4) If you set config.videoGen.script, daily-publisher will execSync that script (run arbitrary code) — only point it at code you trust. 5) Ensure your node version supports global fetch (Node 18+), or the scripts may fail. 6) If you use a self-hosted Postiz instance, double-check POSTIZ_URL in config. In short: behavior is coherent and expected, but treat the Postiz API key and any video-gen script as sensitive/trust decisions.
scripts/daily-publisher.js:220
Shell command execution detected (child_process).
scripts/daily-publisher.js:75
Environment variable access combined with network send.
!
scripts/daily-publisher.js:55
File read combined with network send (possible exfiltration).
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

📲 Clawdis
Binsnode
EnvPOSTIZ_API_KEY
latestvk97af7jqns52tms9v080q60rtx83a946
107downloads
0stars
1versions
Updated 1mo ago
v1.0.0
MIT-0

Indie App Marketing Pipeline

A zero-LLM daily marketing system for indie iOS developers. Write your angles once, then a weekly planner + daily publisher handle the rest — generating platform-native copy and scheduling posts to Postiz automatically.

What the Pipeline Does

  1. Weekly Planner — reads your content bank, picks unused angles, applies platform-specific templates, and writes a weekly-plan-YYYY-MM-DD.json file. No LLM required. Run once per week (or whenever you add new angles).

  2. Daily Publisher — runs each morning (cron at 7 AM), reads that day's entries from the weekly plan, and schedules them to Postiz via its public API.

    • Text posts (X, Facebook) are scheduled directly.
    • TikTok/YouTube Shorts trigger your video-gen script (or skip with --text-only).

The only time you need an LLM is to write new content bank angles when the bank runs dry.

Supported Platforms

PlatformPost typeVolume
TikTokVideo (requires separate video-gen script)3/day
YouTube ShortsVideo (reuses TikTok video)3/day
X / TwitterText tweet, 280-char trimmed2/day
FacebookText brand postMon/Wed/Fri

Architecture

content-bank.json         ← your angles (hook + texts + caption per angle)
       │
       ▼
weekly-planner.js         ← picks angles, renders templates → weekly-plan.json
       │
       ▼
weekly-plan-YYYY-MM-DD.json
       │
       ▼
daily-publisher.js        ← reads today's posts → Postiz API → live schedule
       │
       ▼
Postiz (postiz.com)       ← buffers + publishes to each platform on schedule

Template systemcontent-templates.json defines patterns per platform (hot-take, question-hook, relatable-meme, etc.). The planner cycles through patterns to avoid repetition. Variables: {hook}, {insight}, {cta}, {appName}, {appHandle}, {hashtags}.

Posting historyposting-history.json tracks which angles have been posted so the planner never repeats content until the bank is exhausted.

Setup

1. Accounts Needed

  • Postiz — self-hosted or cloud (postiz.com). Free tier works. Connect your TikTok, YouTube, X, and Facebook accounts in the Postiz UI. Note the integration IDs for each platform.

  • Social accounts — TikTok creator, YouTube channel, X account, Facebook page.

2. Run the Setup Script

cd /path/to/your-app-marketing/
bash skills/indie-app-marketing-pipeline/scripts/setup.sh

The script will:

  • Create the directory structure (plans/, logs/, content-bank.json, etc.)
  • Prompt for your Postiz URL, API key, and platform integration IDs
  • Create a sample content bank with 10 starter angles
  • Create a .env file

3. Configure Your App

Edit config.json (created by setup.sh):

{
  "app": {
    "name": "YourAppName",
    "handle": "@YourHandle",
    "appStoreUrl": "https://apps.apple.com/app/yourapp",
    "websiteUrl": "https://yourwebsite.com",
    "topicCategory": "productivity"
  },
  "postiz": {
    "apiKey": "$POSTIZ_API_KEY",
    "integrationIds": {
      "tiktok": "your-tiktok-integration-id",
      "youtube": "your-youtube-integration-id",
      "x": "your-x-integration-id",
      "facebook": "your-facebook-integration-id"
    }
  }
}

4. Edit Your Content Bank

Fill content-bank.json with angles for your app. See assets/sample-content-bank.json for the format and references/content-bank-guide.md for strategy.

Each angle needs:

{
  "id": "unique-kebab-case-id",
  "hook": "One punchy sentence that is the hook",
  "texts": [
    "Opening line for the video script",
    "Second beat",
    "Third beat / insight",
    "Close"
  ],
  "caption": "TikTok/YouTube caption with hashtags"
}

5. Run the Weekly Planner

node scripts/weekly-planner.js --dry-run          # preview
node scripts/weekly-planner.js                    # write plan
node scripts/weekly-planner.js --week 2026-04-07  # specific start date
node scripts/weekly-planner.js --days 3           # plan just 3 days

6. Run the Daily Publisher

node scripts/daily-publisher.js --dry-run         # preview today
node scripts/daily-publisher.js                   # go live
node scripts/daily-publisher.js --text-only       # skip video, schedule text only
node scripts/daily-publisher.js --skip-past       # skip posts whose time has passed

7. Schedule the Daily Publisher (macOS cron)

# Open crontab
crontab -e

# Add line (runs at 7:00 AM daily):
0 7 * * * cd /path/to/your-app-marketing && node scripts/daily-publisher.js >> logs/cron.log 2>&1

Or use a launchd plist for more control.

Customization

Posting Schedule

Edit the VISUAL_SCHEDULE, X_SCHEDULE, and FB_SCHEDULE arrays in weekly-planner.js. Times are in EST by default — change toISOEst() to use your timezone offset.

Default schedule:

SlotPlatformTime (EST)
tiktok-1TikTok08:00
youtube-short-1YouTube08:15
tiktok-2TikTok13:00
youtube-short-2YouTube13:15
tiktok-3TikTok18:00
youtube-short-3YouTube18:15
x-1X10:30
x-2X16:00
fb-text-1Facebook12:00 (Mon/Wed/Fri)

Content Templates

Edit assets/content-templates.json to customize the copy patterns. The planner rotates through all patterns for each platform. See the template variable reference in references/platform-strategy.md.

Facebook Posts

Facebook posts come from a separate fb-brand-content-bank.json (richer, longer-form content). The weekly planner picks from this bank for Mon/Wed/Fri slots. See references/content-bank-guide.md for how to structure these.

Angles Per Day

Change ANGLES_PER_DAY (default: 3) in weekly-planner.js to post more or fewer video angles per day.

Files Reference

scripts/
  weekly-planner.js        ← generate weekly plan
  daily-publisher.js       ← schedule today's posts to Postiz
  setup.sh                 ← first-time setup

assets/
  content-templates.json   ← platform copy patterns
  sample-content-bank.json ← 10 starter angles

references/
  content-bank-guide.md    ← how to write & maintain your angle bank
  platform-strategy.md     ← platform-specific best practices

References

Comments

Loading comments...