Press Release Writing

Press release writing in AP style with inverted pyramid structure. Covers formatting, datelines, quotes, boilerplates, and fact-checking. Use for: product la...

This skill appears to do what it says (help write AP-style press releases) and uses an external CLI for research, but it instructs running a remote install script (curl | sh) from dist.inference.sh — that installs a binary from a third party and is the main risk. Before installing: (1) Inspect the install script and binary checksums yourself (don’t blindly run curl | sh). (2) Verify the checksum against an independent source and consider downloading via a trusted package manager or a known release host. (3) Run the install in a sandbox or isolated environment if possible. (4) Be mindful that any drafts or company-sensitive queries will be sent to the external inference.sh service — avoid sending secrets or confidential data. (5) Ask the skill maintainer for a clearer, auditable install method and a privacy/terms link describing what inference.sh logs or retains. If you can’t verify the installer or don’t want to send queries externally, treat this skill as risky and avoid installing it.

Type: OpenClaw Skill Name: press-release-writing Version: 0.1.5 The skill is classified as suspicious due to the instruction in `SKILL.md` for the agent to execute `curl -fsSL https://cli.inference.sh | sh`. This command downloads and runs an arbitrary shell script from a remote server, posing a significant supply chain risk and potential for Remote Code Execution (RCE) if the remote script or server is compromised. While the skill's stated purpose of press release writing and fact-checking is benign, and the accompanying note attempts to justify the installation method, the instruction to execute untrusted remote code is a high-risk behavior and a vulnerability. Additionally, the skill instructs the agent to add other skills from `inference-sh/skills`, further expanding the reliance on external, potentially untrusted components.