Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Content Strategy Analyzer
v1.0.0Analyzes websites to generate multi-language content strategy, keyword research, and competitor analysis. Use when user provides a URL and needs industry ana...
⭐ 0· 338·0 current·0 all-time
by@yanzt
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill claims to perform AI analysis using 'Opencode AI' (identify industry/competitors, generate keywords by country/language), but none of the provided code calls any external AI API or mentions endpoints/credentials. The two included Python scripts only crawl the provided URL and generate an Excel from local JSON. Either the SKILL.md overclaims capabilities or it omits the integration code/credential requirements.
Instruction Scope
Runtime instructions are mostly constrained: ask user for URL/country/language/frequency, run crawl_website.py to save website_data.json, then run generate_excel.py to make an Excel. The 'AI analysis' step is vague and unspecified (no prompts, no API calls), giving the agent wide discretion about how to perform the analysis. The crawler does not check robots.txt or rate limiting, and some extraction fields are unimplemented (headings/content_blocks are empty), which are implementation details rather than direct red flags.
Install Mechanism
No install spec is provided (instruction-only), and the declared Python dependencies (requests, beautifulsoup4, openpyxl) are reasonable and proportional to crawling and Excel generation. No remote downloads or execution of external archives are present.
Credentials
The skill declares no required environment variables or credentials, yet the documentation explicitly names an external AI service ('Opencode AI') for analysis. If that service requires an API key or endpoint, the skill should declare and justify those env vars. Currently there's a mismatch between claimed use of an external AI provider and the lack of any credential/config requirements.
Persistence & Privilege
The skill does not request persistent installation, does not set always:true, and does not modify other skills or system-wide settings. It runs local scripts and writes local files (website_data.json, content_plan.xlsx) only, which is expected for its purpose.
What to consider before installing
Before installing or running this skill, consider the following:
- Clarify how the 'AI analysis' step is implemented: does it call an external 'Opencode AI' API? If so, ask the author for the endpoint and which credentials (API key) are required and why. The skill currently does not declare any env vars for that, which is an incoherence.
- Review the two included scripts yourself. They are small and straightforward: crawl_website.py issues an HTTP GET to the target URL and saves a JSON, generate_excel.py reads local JSON and writes an Excel file. There is no hidden network exfiltration in the scripts as provided.
- Note the crawler does not respect robots.txt or perform rate limiting. If you plan to crawl third-party sites, ensure you have permission and run it responsibly (or modify the script to check robots.txt and throttle requests).
- Because the SKILL.md is vague about how keyword and competitor analysis are generated, confirm whether the agent will use your account/model (and any associated billing) or call an external API. If the agent will call an external service, restrict or inspect outbound network access and do not provide secrets until you verify the service.
- If you will run this skill in a shared environment, consider executing it inside a sandbox/container and inspecting network traffic to confirm no unexpected endpoints are contacted.
- If you need the full promised feature (multi-country AI-driven competitor analysis), request that the skill author either include the integration code (with secure credential handling) or update the documentation to explain how the AI analysis step is performed.Like a lobster shell, security has layers — review code before you run it.
latestvk97bxv3g5b08mw65vb9wfqbewn81vf77
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
