Newsletter Curation

Newsletter curation with content sourcing, editorial structure, and subscriber growth strategies. Covers issue formatting, link roundups, commentary style, a...

This skill appears to do what it says (templates, sourcing queries, editorial guidance), but exercise caution before following its install steps. The SKILL.md recommends running a remote installer with curl | sh and then running `infsh login` — both can execute code on your machine and may request/store credentials. Before installing: 1) inspect the installer script (visit https://cli.inference.sh) instead of piping it straight to shell; verify the SHA-256 checksums from the stated source; 2) consider running the installer in a sandbox or VM; 3) be prepared that the CLI may ask for API keys or authorize services (which are not declared by the skill); only provide tokens with least privilege; 4) if you cannot or will not verify the installer, avoid running it and instead perform the content-sourcing steps manually with known tools. If you want higher assurance, ask the skill author for the exact installer script, its checksum, and documentation on what `infsh login` stores and where.

Type: OpenClaw Skill Name: newsletter-curation Version: 0.1.5 The SKILL.md file contains instructions for the agent to execute `curl -fsSL https://cli.inference.sh | sh` and `npx skills add ...` commands. These commands are outside the explicitly defined `allowed-tools: Bash(infsh *)` scope. While the stated purpose is to install a CLI tool, instructing the agent to execute arbitrary shell commands (like `curl | sh` or `npx`) represents a prompt injection attempt and a potential Remote Code Execution (RCE) vulnerability if the agent's security controls (e.g., `allowed-tools` enforcement) are bypassed or misinterpreted. There is no clear evidence of intentional malicious activity beyond this risky execution pattern.