Research

Deep market research — competitor analysis, user pain points, SEO/ASO keywords, naming/domain availability, and TAM/SAM/SOM sizing. Use when user says "resea...

This skill appears to do what it claims, but before installing consider: (1) it performs many web fetches and browser automation (including instructions to use old.reddit.com to avoid CAPTCHAs) — ensure you are comfortable with automated scraping and the target sites' terms of service and rate limits; (2) it runs domain checks via whois/dig and makes curl requests (your agent must have network access and the relevant CLI tools available); (3) it references optional installs (e.g., PRAW) and internal MCP project/code search tools — if you grant the agent access to private project data, the skill can read that data, so scope those permissions carefully; (4) no credentials are requested, which is good, but watch for future edits that might add API keys or other sensitive requirements. If you need tighter control, restrict the skill's web/network access or run research jobs in a sandboxed environment.

Type: OpenClaw Skill Name: solo-research Version: 1.7.1 The skill is classified as suspicious due to its extensive use of powerful tools, particularly `Bash`, `WebSearch`, `WebFetch`, and `Playwright` (browser automation), which provide broad system and network access. While the instructions in `SKILL.md` and `references/domain-check.md` are aligned with the stated purpose of market research (e.g., using `curl` for API calls, `whois`/`dig` for domain checks, `pip install` for a legitimate library), these capabilities present a significant attack surface. An attacker could potentially exploit these tools via prompt injection against the AI agent to execute arbitrary commands, exfiltrate data, or perform other unauthorized actions, even though the skill itself does not demonstrate malicious intent.