Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Musician Manager

v1.1.0

AI Band Manager skill for musicians. Use when handling any music industry task — venue booking outreach, social media content, release planning, setlist mana...

0· 104·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for boris148/musician-manager.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Musician Manager" (boris148/musician-manager) from ClawHub.
Skill page: https://clawhub.ai/boris148/musician-manager
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install musician-manager

ClawHub CLI

Package manager switcher

npx clawhub@latest install musician-manager
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The skill's features (venue outreach, social posting, calendar, contract review, video generation, telephony) are consistent with a band-manager purpose. However, it lists many integrations (Telegram/WhatsApp, Postiz, ElevenLabs, Kling AI, Google Calendar, Email and references other skills) that would normally require credentials or explicit instructions for access; those are not declared anywhere in the metadata.
Instruction Scope
SKILL.md stays on-topic for music-management tasks and does not instruct the agent to read arbitrary system files or hidden locations. It does, however, expect the agent to perform potentially sensitive actions (sending outreach emails, accessing calendars, handling fan/contact lists, making AI phone calls, analyzing contracts). Those operations require access to user data and external services but the skill gives no detail on how credentials will be obtained or how user data/privacy is handled.
Install Mechanism
This is an instruction-only skill with no install spec and no code files, which minimizes on-disk execution risk. No downloads or package installs are specified.
!
Credentials
The skill declares no required environment variables or primary credential but claims integration with many external services that normally require API keys, OAuth tokens, or account access. The lack of declared credentials is disproportionate and opaque — you should expect at minimum access requirements for email/SMTP, calendar (Google OAuth), social posting service tokens, telephony or voice-service credentials, and any third-party AI/video services.
Persistence & Privilege
always:false and normal autonomous invocation settings are used. The skill does not request persistent system-level changes in the metadata. Note: if granted broad credentials, autonomous invocation increases blast radius, but autonomous invocation alone is not unusual.
What to consider before installing
Before installing or enabling this skill, ask the publisher for: (1) source code or a homepage and an author identity; (2) an explicit list of required credentials/env vars and the minimum OAuth scopes needed for each integration (email/SMTP, Google Calendar, Telegram/WhatsApp, Postiz, ElevenLabs, Kling AI, any telephony provider); (3) how credentials are obtained (interactive OAuth vs. asking you to paste long-lived secrets) and where they are stored; (4) privacy/data-retention policy for fan/contact data, voice call logs, contracts, and analytics; (5) whether the skill will call other skills (Postiz/Larry, ai-music-video) and what credentials those other skills require. Do not provide account-level or long-lived secrets without least-privilege scoping and a clear trust signal (source repo, publisher identity, or reviews). If you still want to test it, use throwaway/sandbox accounts and deny broad permissions until you confirm behavior. If the publisher cannot provide clear answers, treat the skill as untrusted.

Like a lobster shell, security has layers — review code before you run it.

latestvk971xa4bq75thf126yfg9h8xe583nyn2
104downloads
0stars
2versions
Updated 1mo ago
v1.1.0
MIT-0

Musician Manager — AI Band Manager

Turn OpenClaw into a full-service AI band manager for independent musicians.

Capabilities

1. Venue Booking & Outreach

  • Research venues by city, genre, capacity
  • Draft professional booking emails
  • Track outreach status (sent, replied, confirmed, rejected)
  • Calendar management for shows
  • Follow-up reminders

2. Social Media Content

  • Generate post ideas based on band activity
  • Create captions with proper hashtags for music audience
  • Schedule content calendar (release countdown, behind-the-scenes, etc.)
  • Cross-platform posting via Postiz/Larry skill
  • Analytics tracking and optimization

3. Release Planning

  • Create release timeline (8 weeks out → release day → post-release)
  • Pre-save campaign management
  • Playlist pitching email templates
  • Social media blitz scheduling
  • Fan email/SMS announcements

4. AI Music Video Production

  • Full pipeline using Kling AI (see ai-music-video skill)
  • Lyric transcription → scene concepts → image generation → video stitching
  • Proven: NDGO "VIBE" music video — 20 scenes, 3 minutes, made overnight

5. Setlist Management

  • Generate setlists based on venue type, set length, crowd energy flow
  • Track which songs get best crowd response
  • Suggest opening/closing songs based on data

6. Tour Logistics

  • Route optimization between cities
  • Venue load-in/soundcheck time tracking
  • Day sheet generation
  • Budget tracking (gas, hotels, food, merch)

7. Contract Analysis

  • Review performance contracts for red flags
  • Identify unfavorable terms (pay-to-play, excessive sound buy requirements)
  • Suggest counter-offers
  • Track payment terms and follow up on outstanding payments

8. Fan Engagement

  • Email list management and newsletters
  • DM response drafting
  • Fan data analysis (where are they, what do they engage with)
  • Street team coordination

Voice Commands (Hey Boris)

When the voice assistant is active, these are natural language triggers:

  • "Hey Boris, find me venues in [city] that book [genre] bands"
  • "Hey Boris, draft a booking email for [venue]"
  • "Hey Boris, what shows do we have this month?"
  • "Hey Boris, post our new single announcement"
  • "Hey Boris, create a release plan for [song name]"
  • "Hey Boris, what's our setlist for tonight?"
  • "Hey Boris, analyze this contract" (then share document)

Integration Points

  • Telegram/WhatsApp: Primary communication channel
  • Hey Boris: Hands-free voice commands
  • Postiz: Social media posting and analytics
  • ElevenLabs: Voice responses and AI phone calls
  • Kling AI: Music video generation
  • Google Calendar: Show scheduling
  • Email: Venue outreach, fan newsletters

Target Audience

  • Independent musicians (solo or band)
  • Small to mid-level artists (0-100k monthly listeners)
  • DIY artists who can't afford a manager
  • Small labels managing multiple artists
  • Booking agents looking for efficiency tools

Comments

Loading comments...