Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Claude Sonnet 4 Lite Agent
v0.1.0Efficiently create content by rapidly advancing tasks, handling failures by stopping after two retries, and strictly following provided research and templates.
⭐ 0· 704·3 current·3 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name and description claim an efficient content-creation agent; the SKILL.md contains stepwise content-creation workflows and tool usage rules consistent with that purpose.
Instruction Scope
The instructions impose several restrictive and ambiguous runtime behaviors: (1) they mandate using python_code_execution for generating webpages and other attachments (this forces use of an execution tool that may have filesystem and network access at runtime), (2) they forbid asking the user clarifying questions at the 'Submit' stage, (3) the Anti-Stall Protocol halts after two failures and requires marking items '[Blocked]' and 'logging' without specifying where logs should go, and (4) they limit searches to at most one targeted search. These directives are operationally risky (can prematurely stop useful work) and are vague about where sensitive data or logs are written.
Install Mechanism
Instruction-only skill with no install spec and no code files. Nothing will be written to disk by the skill package itself during install.
Credentials
The skill does not request environment variables, credentials, or config paths. Template variables like $DATE$ and $SESSION_GROUP_ID$ are referenced but are expected runtime substitutions rather than secrets.
Persistence & Privilege
always is false and there are no instructions to modify agent-wide configuration or other skills. The skill does require use of runtime tools but does not request persistent presence or escalation.
What to consider before installing
This skill appears to be a focused content-creation agent, but its runtime instructions have a few red flags you should understand before installing: (1) it forces use of python_code_execution for webpages and attachments — if your platform's python executor has filesystem or network access, that increases the risk of unexpected data reads/writes or exfiltration, (2) it forbids asking clarifying questions at submission time and restricts searches, which can cause incorrect outputs or unhelpful blocking, (3) the 'log the reason' requirement is unspecified — ask where logs will be stored and who can read them. Because this is instruction-only, the main risk is what tools the agent will be allowed to use at runtime. If you plan to install: (a) confirm what runtime tools (especially python_code_execution) are available and their privilege scope (file and network access), (b) ask the publisher to clarify logging behavior and where blocked-item logs go, and (c) consider running the skill in a restricted environment (no network, limited filesystem) first. If you cannot validate these details, treat installation with caution.Like a lobster shell, security has layers — review code before you run it.
latestvk9708a0f8zc95y8chwzzbscyb5817psh
License
MIT-0
Free to use, modify, and redistribute. No attribution required.