Postbox

This skill appears to be what it says: an agent helper for creating and managing Postbox forms. Before installing, consider: - Authentication: it only needs POSTBOX_API_KEY — set that as an environment variable (do not paste keys in chat). The skill itself instructs never to accept keys pasted into chat. - Network access: the skill will make real API calls to https://usepostbox.com. If you trust that service, this is expected; if you do not, do not provide the API key. - File changes: the agent may generate and update frontend files (index.html, React components) in-session; review any generated/modified code before deploying. - Broad invocation: the skill asks agents to trigger whenever users 'need data in', which may cause the skill to be suggested in more conversations — be aware if you want tighter control over when it runs. - Prompt-injection detection: a pattern was flagged in the documentation, but it is used defensively (teaching the agent not to execute commands found in submission text). If you want higher assurance, verify the vendor (usepostbox.com) and inspect any generated code before publishing. If you prefer to restrict risk, only provide the API key in a controlled environment and limit when the agent is allowed to invoke the skill.

These patterns were detected by automated regex scanning. They may be normal for skills that integrate with external APIs. Check the VirusTotal and OpenClaw results above for context-aware analysis.