Content Draft Generator

PassAudited by ClawScan on May 1, 2026.

Overview

This instruction-only skill is coherent and low risk, but users should notice that it fetches user-provided links, may use a third-party Twitter/X fetch service, and saves generated content locally.

This skill appears safe to use for drafting. Provide only reference URLs you are comfortable fetching, be aware that Twitter/X links are routed through FxTwitter, and review or delete the generated markdown files if they contain confidential ideas or unpublished content.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence
ASI01: Agent Goal Hijack
What this means

A misleading or adversarial reference page could skew the generated prompt or drafts if its text is followed too literally.

Why it was flagged

User-provided webpages influence a prompt that the agent later executes. This is central to the skill, but reference content can include text that should not be treated as instructions.

Skill content
Fetch content from all reference URLs (use web_fetch tool) ... create a two-phase prompt ... Execute Meta Prompt
Recommendation

Use trusted reference URLs and keep fetched page text as source material only; review the generated meta-prompt and drafts before relying on them.

What this means

Twitter/X reference URLs you provide may be sent to FxTwitter to retrieve the content.

Why it was flagged

The skill discloses that Twitter/X URLs are fetched through a third-party API endpoint. This is purpose-aligned, but it is an external data flow users should understand.

Skill content
For Twitter/X URLs, transform to FxTwitter API: `https://api.fxtwitter.com/username/status/123456`
Recommendation

Only provide public, non-sensitive Twitter/X links and avoid using private or confidential URLs as references.

What this means

Your unpublished ideas, audience details, positioning, and drafts may remain in local markdown files after the session.

Why it was flagged

The workflow intentionally creates persistent local files containing analysis, user context, and draft content. This is proportionate to the purpose, but may retain sensitive ideas or marketing plans.

Skill content
Save complete output to `content-draft/draft-{timestamp}.md` ... Include: Context summary from Phase 1 ... Preserve all generated files—never overwrite
Recommendation

Review where the files are saved and delete or protect them if they contain confidential content.