AI Opportunity Scout

Find profitable business opportunities in any niche by scanning Twitter, web, Reddit, and Product Hunt for unmet needs and pain points. Scores each opportuni...

What to consider before installing: 1) The scoring script is benign and local-only — it just formats and ranks opportunities. 2) SKILL.md tells the agent to run external CLIs (notably 'bird' for Twitter and 'clawdhub') via shell exec; those tools typically require installation and stored credentials. The skill does not declare those prerequisites or any credential requirements, so the agent may try to use whatever local CLI config/tokens exist (which could expose or use your account). 3) If you plan to use this skill: verify what 'bird' and 'clawdhub' binaries do on your system, confirm where they read credentials from, and only run the skill in an environment where you trust those CLI configs. Alternatively, ask the skill to use authenticated API keys you control or to rely only on web_search queries (no exec). 4) Because the skill's source and homepage are unknown, exercise caution with network-enabled operations and prefer running it in a sandboxed agent or reviewing/limiting what tools the agent may exec.

Type: OpenClaw Skill Name: opportunity-scout Version: 1.0.0 The skill bundle is classified as suspicious due to the potential for shell injection. The `SKILL.md` instructs the AI agent to execute external commands (`bird search` and `clawdhub search`) via `exec`, passing user-controlled input (`[niche]`) directly into these commands. If the `bird` or `clawdhub` tools, or the agent's `exec` mechanism, do not properly sanitize this input, a malicious user could craft a `niche` string to execute arbitrary shell commands. This represents a significant vulnerability, even though the skill itself does not demonstrate explicit malicious intent like data exfiltration or backdoor installation.