Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Content Repackage

v1.0.0

Convert markdown content into multiple formats instantly. Transform one article into Twitter threads, email digests, and HTML landing pages. Zero dependencie...

0· 89·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for zhiuannnn/content-repackage.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Content Repackage" (zhiuannnn/content-repackage) from ClawHub.
Skill page: https://clawhub.ai/zhiuannnn/content-repackage
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install content-repackage

ClawHub CLI

Package manager switcher

npx clawhub@latest install content-repackage
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The name, description, SKILL.md, and the main script all align: they read a Markdown file and produce Twitter/X threads, an email digest, and an HTML landing page. However the main script imports './libs/md-parser' and './libs/generators' which are not present in the package manifest. The SKILL.md claims "Zero dependencies, works offline," but those relative modules are required for functionality and are missing — this mismatch is an incoherence.
!
Instruction Scope
SKILL.md instructs only to run `node content-repackage.js <input.md> [output-dir]` and describes local file I/O only. The main script likewise only reads the input file and writes outputs, with no network calls or credential access. The problem: the runtime instructions implicitly depend on the two local libraries (./libs/...) which are not included; without them the script will fail. Because the absent modules are responsible for parsing and generation, their contents are unknown and should be reviewed before trusting the skill.
Install Mechanism
No install spec and no external downloads. The skill is instruction-only plus a single JS file — this is low install surface. Nothing in the package attempts to fetch or install code at runtime.
Credentials
No environment variables, credentials, or config paths are requested. The declared resource needs are minimal and proportionate to the stated task.
Persistence & Privilege
Skill does not request persistent or elevated privileges (always is false, normal model invocation allowed). It only performs local file reads/writes in the specified output directory.
What to consider before installing
This skill appears to do what it says (convert markdown into threads, email text, and an HTML page) and does not request credentials or network access in the files you can see. However, the main script requires two local modules (./libs/md-parser and ./libs/generators) that are not included in the package — without them the tool will fail and you cannot audit what those modules would do. Before installing or running: 1) ask the publisher for the missing files or a complete package; 2) request a flattened single-file implementation or include the ./libs directory so you can inspect it; 3) if you must run it, do so in an isolated/sandbox environment and review the missing modules for any network calls or credential access; 4) prefer installing only from a trusted, verifiable source (repository or homepage) rather than an anonymous package. If the absence of the libs was a packaging mistake and the missing files are benign, the skill would be coherent — but until you can inspect them, treat this as suspicious.

Like a lobster shell, security has layers — review code before you run it.

latestvk97e2d2x9jgbgsfm3c8fqj1znh84hj7r
89downloads
0stars
1versions
Updated 2w ago
v1.0.0
MIT-0

Content Repackage

Convert markdown to Twitter threads, emails, and HTML landing pages in one click.

Usage

node content-repackage.js <input.md> [output-dir]

Input

Any markdown file with optional frontmatter.

Output

Twitter Thread

  • Auto-splits into 280-char tweets
  • Preserves sentence boundaries
  • Adds thread numbers

Email Digest

  • Clean subject line from title
  • Proper formatting

HTML Landing Page

  • Mobile-responsive design
  • Dark theme
  • No external dependencies

Use Cases

  • Content creators
  • Newsletter authors
  • Developers documenting projects
  • Marketers creating campaign materials

Comments

Loading comments...