Product Changelog

Product changelog and release notes that users actually read. Covers categorization, user-facing language, visuals, and distribution. Use for: release notes,...

This skill is an instruction-only helper for writing changelogs and optionally generating visuals via the third-party inference.sh CLI. Before running anything: (1) verify you trust the inference.sh domain and the dist.inference.sh checksums rather than blindly running curl | sh; consider manual download and checksum verification; (2) be aware infsh login will create credentials for that external service — treat those like any API key; (3) if you prefer safer testing, run the install and visual-generation commands in an isolated environment (container or VM); (4) if you need stronger assurance, ask the publisher for an authoritative homepage or code repo (the skill lists no source/homepage). If the inference.sh domain or the referenced app names are unfamiliar or untrusted, treat the install step as potentially risky.

Type: OpenClaw Skill Name: product-changelog Version: 0.1.5 The skill is classified as suspicious due to two main factors. First, the `SKILL.md` instructs users to install the `inference.sh` CLI via `curl -fsSL https://cli.inference.sh | sh`. While the skill includes a disclaimer about the script's safety, this 'pipe to shell' method is an inherent supply chain risk, as it executes arbitrary code from a remote source without prior inspection. Second, the skill allows the agent to use `infsh app run infsh/agent-browser` to visit arbitrary URLs and take screenshots. This capability, while intended for legitimate purposes like generating feature visuals, introduces a potential Server-Side Request Forgery (SSRF) or information disclosure vulnerability if the agent is prompted to visit malicious or internal network URLs without proper input sanitization or sandboxing. There is no direct evidence of malicious intent, but these practices present significant security risks.