Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

startup-researcher

v1.3.2

Research AI startups, funding, and product announcements. Generates a structured intelligence report as a PDF. Use when asked to research startups, update th...

0· 147·1 current·1 all-time
byXiaoyu Kevin Hu@hxy9243

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for hxy9243/startup-researcher.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "startup-researcher" (hxy9243/startup-researcher) from ClawHub.
Skill page: https://clawhub.ai/hxy9243/startup-researcher
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install startup-researcher

ClawHub CLI

Package manager switcher

npx clawhub@latest install startup-researcher
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
Name/description (startup research + PDF output) matches the instructions and included files: watchlist.yaml, research prompts, report compiler, CSS, and example profiles. Declared dependencies (Python, Markdown, WeasyPrint) are reasonable for generating styled PDFs and markdown-to-HTML conversion. No unrelated credentials, binaries, or config paths are requested.
Instruction Scope
SKILL.md explicitly instructs the agent to perform web searches, use a browser subagent, save per-company markdown profiles under references/<date>/..., aggregate category analyses, and generate a PDF. These steps are in-scope for the stated purpose. Two operational notes: (1) the skill tells the agent to always read the local watchlist.yaml and many bundled prompt files — expected for an orchestrator; (2) it instructs installing system C-libraries (pango/cairo/gdk-pixbuf) when WeasyPrint is not present, which requires package-manager commands and potentially elevated privileges; this is proportional to PDF generation but you should confirm you want the agent to run installs in your environment.
Install Mechanism
There is no automated install spec — this is instruction-only. The README suggests an npx install command for the repo, but the running instructions only recommend using the agent's tools to install Python packages or OS libraries if missing. No downloads from arbitrary URLs or extracted archives are required by the skill itself.
Credentials
The skill requests no environment variables, no external credentials, and no config paths. The prompts ask the agent to consult public sources (company websites, Crunchbase, news) which is consistent with the research goal. There are no requests for unrelated secrets or tokens.
Persistence & Privilege
always:false (not force-included). The skill writes files into a local workspace (references/<date>/...), which is expected for an orchestrator that saves intermediate profiles and final outputs. It does not request to modify other skills or global agent settings.
Assessment
This skill appears to do what it says: run web research, save per-company markdown profiles, synthesize category analyses, and produce a styled PDF. Before installing or running it, consider: (1) PDF generation: the skill may try to install system C-libraries (apt/brew/dnf) if WeasyPrint is absent — running these commands requires package-manager access and sometimes root privileges, so only allow installs in an environment where you trust the agent to run them; (2) file writes: it will write temporary and final files to your workspace under references/<date>/..., so ensure that directory is appropriate and does not contain sensitive data; (3) web access: the agent will browse and fetch public sites (including paywalled sources like Crunchbase/Pitchbook), so expect network activity and possible rate limits; (4) autonomous invocation: the skill can be invoked autonomously by the agent (default) and has tools to call the browser subagent, run shell commands, and write files — if you want to restrict automated runs, disable or require confirmation before execution. If you want to avoid installs, pre-provision Python + weasyprint + system libraries in the environment and/or instruct the agent not to attempt package-manager installs.

Like a lobster shell, security has layers — review code before you run it.

latestvk9770yk0hgcx9472n5zf0jm5wn83jwe6
147downloads
0stars
5versions
Updated 1mo ago
v1.3.2
MIT-0

Startup Researcher Orchestrator

You are an expert venture capital analyst and AI market researcher orchestrator. Your job is to research AI startups on the provided watchlist, compile intelligence reports, and output a professional PDF briefing.

The Watchlist

The user can optionally specify the companies to research. If not, the target companies are categorized in watchlist.yaml. Always read watchlist.yaml in this directory to know who to track.

Dependencies & Setup

This skill uses WeasyPrint for native PDF rendering. If weasyprint or python3 -m markdown is not available in your environment, use your tools to install them and their required C-libraries before proceeding:

  • macOS: brew install pango cairo gdk-pixbuf libffi
  • Ubuntu/Debian: apt-get update && apt-get install -y libpango-1.0-0 libcairo2 libgdk-pixbuf2.0-0 shared-mime-info
  • Fedora/RHEL: dnf install -y pango cairo gdk-pixbuf2
  • Python Packages: pip3 install weasyprint markdown

Research Workflow

  1. Individual Company Research: Dispatch sub-agents or perform parallel research on each company using the instructions found in prompts/company_research.md.

    • Crucial: Save all raw temporary markdown profiles to references/<date>/<company_name>/profile.md. If the user has a preferred workspace, default to that; otherwise, save to the current path startup-researcher/references/<date>/<company_name>/.
  2. Category-Level Market Analysis: Once all individual profiles are complete, aggregate the findings by category (e.g., Custom Silicon, Base Model). Follow the instructions in prompts/market_analysis.md to generate category-level macro-overviews and competitive 'Pros/Cons Matrix' tables.

  3. Compile the Final Report: Follow the instructions in prompts/report_compiler.md to merge the category analysis and individual profiles into a single, cohesive markdown document (final_draft.md) and save to references/<date>/final_draft.md.

    Use WeasyPrint with the custom style.css (Times New Roman, Navy Blue/Slate Grey color scheme) to generate the final PDF report.

    Example commands:

    python3 -m markdown -x tables -x toc final_draft.md > final_draft.html
    weasyprint final_draft.html final_draft.pdf -s style.css
    

    Text paragraphs should use justified alignment.

  4. Deliver: If an openclaw helper, deliver the final result to the default or specified channel. Otherwise save to the workspace and return the file path.

Gotchas & Rate Limits

  • RATE LIMITS: Batch your searches and synthesize incrementally to avoid context bloat. Wait if you hit limits.
  • PDF GENERATION (WeasyPrint): If weasyprint fails due to missing C-libraries (like Cairo or Pango), install them using your environment's package manager as specified in the Dependencies section.

Comments

Loading comments...