Content Claw

This skill appears to be what it claims (content extraction + topic discovery + image gen) but exercise caution before running it: - Review any remote install scripts (the SKILL.md suggests running a curl install.sh for 'uv') before executing; prefer installing uv from a package manager you trust. - uv sync will install third-party Python packages (playwright, fal-client, exa-py). Audit those packages and their versions if you require high assurance. - Use scoped, low-privilege API keys for FAL_KEY and EXA_API_KEY and rotate them after testing. Do not provide high-privilege or long-lived credentials. - Run the skill in a sandbox or container the first few times, especially because it launches a headless browser and performs web scraping (the code intentionally uses stealth techniques that could violate site terms). - Verify generate_image.py and related scripts to confirm only condensed image specs (not full source documents) are sent to fal.ai, and that no sensitive source content is transmitted to Exa or other endpoints. - Be cautious about trusting the skill's 'do not access files outside BASE_DIR' rule: the instruction is self-enforced in documentation. If you need strict containment, run it in an environment that enforces filesystem isolation. If you want, I can: (a) show the contents of scripts/generate_image.py to verify what is sent to fal.ai, (b) list the exact Python dependencies and their versions from pyproject.toml, or (c) suggest a minimal, sandboxed test plan to validate behavior safely.