Ai Content Tailor

PassAudited by ClawScan on May 1, 2026.

Overview

This skill coherently rewrites user-selected articles with OpenAI, but users should notice that it requires an OpenAI API key, sends article text to OpenAI, and uses a manual pip-based installer.

Before installing, be comfortable with a manual pip-based setup, an OpenAI API key, and sending the articles you choose to OpenAI. Use a dedicated key, consider a virtual environment, and avoid processing sensitive drafts unless that data flow is acceptable.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI03: Identity and Privilege Abuse

What this means

Using the skill can consume the user's OpenAI quota or incur API charges.

Why it was flagged

The skill uses an OpenAI API key to authenticate requests. This is expected for its LLM rewriting purpose, but it gives the skill access to billable OpenAI API usage under the user's account.

Skill content

OPENAI_API_KEY = os.getenv("OPENAI_API_KEY") ... client = OpenAI(api_key=OPENAI_API_KEY)

Recommendation

Use a dedicated API key if possible, monitor usage, and revoke or rotate the key if you stop using the skill.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Private drafts, unpublished content, or confidential material included in input files may be transmitted to OpenAI for processing.

Why it was flagged

The article content is embedded into the prompt sent to OpenAI. This external provider call is disclosed and central to the skill, but it means processed article text leaves the local machine.

Skill content

full_prompt = f"{prompt}\n\n原文：\n{article}\n\n请输出改写后的内容：" ... client.chat.completions.create(

Recommendation

Avoid processing confidential content unless you are comfortable with OpenAI handling it under your account and data settings.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installation may modify the user's Python environment and will fetch whatever compatible package versions are available at install time.

Why it was flagged

The installer downloads Python dependencies at install time without pinning exact versions in the script. These dependencies are purpose-aligned, but live unpinned installs depend on package-index trust and current package state.

Skill content

pip3 install openai python-dotenv --quiet

Recommendation

Install in a virtual environment if possible and consider pinning or reviewing dependency versions before running the installer.