Social Brand Voice

Brand voice guide creator for social media. Define your brand's tone, vocabulary, writing rules, and examples across platforms — so every post sounds consist...

This skill appears to do what it says (generate a brand voice guide) and contains a small helper script that invokes your OpenClaw agent. Before installing or running it: 1) Confirm you have the openclaw CLI and python3 available (the metadata doesn't list them but analyze.sh requires them). 2) Review and avoid passing any sensitive secrets or private customer data to the script — the input is forwarded to your agent and may be sent to whatever model endpoint your OpenClaw configuration uses. 3) If you want clearer safety, ask the publisher to add required-binaries (openclaw, python3) to the metadata and to document whether the agent runs completely locally or contacts a hosted API. 4) If you are uncertain about where your data will go, run the script in an isolated environment or with dummy inputs first.

Type: OpenClaw Skill Name: social-brand-voice Version: 1.0.0 The skill is designed to generate brand voice guides, but the core logic in `analyze.sh` contains a shell injection vulnerability. It embeds unsanitized user input (`${INPUT}`) directly into a double-quoted string (`PROMPT`), which allows for arbitrary command execution via command substitution (e.g., `$(...)` or backticks) when the script is executed. While the intent appears to be a legitimate utility for brand strategy, the lack of input sanitization in a script that handles user-provided text poses a high risk of remote code execution (RCE).