Reddit Quote Carousel Topaz

Create an Instagram carousel from a popular-picks list with Reddit quotes + Topaz 2x upscaling. Cover = "clean" style ("Top CATEGORY in Destination"), attrac...

Do not install or grant this skill full autonomy until the author clarifies and fixes the mismatches. Questions / actions to request before proceeding: 1) Declare exactly which credentials/configs are required (Topaz API key, Instagram Graph API token, instagram-account-id, and any Git credentials) and the expected mechanism (env vars vs Keychain). 2) Remove or explain the hardcoded local path (/Users/psy/...) and provide a portable overlay tool or a dependency list/install instructions. 3) Confirm target repository and whether the skill will push to a public repo; require explicit git credentials and least-privilege tokens. 4) Note the platform assumption (macOS Keychain use) and either add an alternative for other OSes or restrict OS support in metadata. 5) If you must use this skill, run it in a sandboxed agent and avoid giving it a long‑lived Instagram token with publish scope — use a short‑lived/test account and review activity logs. 6) Consider disabling autonomous invocation (require manual approval) until you trust the behavior. If the author cannot or will not address these issues, treat the skill as risky and do not provide it access to your Keychain or publish tokens.

Type: OpenClaw Skill Name: reddit-quote-topaz Version: 1.0.0 The skill bundle is classified as suspicious due to two primary risky capabilities, even though there is no clear evidence of intentional malicious behavior. First, the `popular_picks_url` parameter is user-controlled and directly fed to `web_fetch` without explicit sanitization or validation instructions, creating a potential Server-Side Request Forgery (SSRF) or Local File Inclusion (LFI) vulnerability if the `web_fetch` function is not robustly secured. Second, the skill includes instructions for `git push` operations to host images, which implies the agent has broad write permissions to a repository. While these actions are plausibly needed for the stated purpose of creating Instagram carousels, they represent significant attack surfaces if the agent's environment or input handling is not perfectly secure.