Content Creator Pro

You have something to say but crafting platform-perfect posts for X, LinkedIn, Instagram, and TikTok is a full-time job. Content Creator Pro learns your bran...

This skill appears to do what it says: local-first content generation with brand profiles saved as JSON. Before installing: 1) Inspect the files yourself (data files are plain JSON) and confirm you are comfortable keeping brand data locally. 2) If you plan to use web_fetch or paste URLs, only allow explicit https:// URLs you trust — the skill's doc enforces this but you should still supervise fetched content. 3) Review scripts/export-calendar.sh — it contains a workspace-detection bug that will cause it to fail; fix or test the script before relying on exports. 4) SETUP-PROMPT runs a find over $HOME to locate the skill package — verify the discovered SKILL_DIR before copying to avoid accidental file operations. 5) If you later deploy the dashboard or a hosted DB, treat that as a separate integration that will require credentials and network access; review the dashboard code and hosting choices carefully. Overall, there are no red flags of credential exfiltration or hidden network calls in the packaged files — the issues found are implementation bugs and usability items rather than malicious behavior.

Type: OpenClaw Skill Name: normieclaw-content-creator-pro Version: 1.0.3 The Content Creator Pro skill bundle is a legitimate social media management tool that aligns with its stated purpose. It includes robust security guardrails in SKILL.md, such as explicit prompt-injection defenses and strict rules against exfiltrating sensitive brand data to external URLs. The bundle follows security best practices by instructing the agent to set restrictive file permissions (chmod 600/700) and includes a SECURITY.md audit. While the export-calendar.sh script contains a logic error in its directory traversal that prevents it from executing correctly, this appears to be a non-malicious bug rather than a vulnerability or intentional harm.