AI-powered blog title optimizer. Generate SEO-friendly, click-worthy headlines that drive traffic.

This skill appears to do what it claims, but there are a few things to check before installing or running it: - Verify the 'openclaw' binary you will execute is legitimate and from a trusted source; the skill runs this CLI locally. - The package contains a hardcoded SKILLPAY merchant key. If you care where payments go, replace SKILLPAY_MERCHANT_KEY with your own merchant key or use the --test flag to avoid charges during evaluation. Embedded merchant keys mean the author (or whoever controls that key) will receive payments by default. - The registry metadata omits the required 'openclaw' binary; expect to need OpenClaw/Sloan locally even though the metadata lists none. - package-lock.json shows dependencies fetched from mirrors.tencentyun.com (a non-default registry mirror). If you will install dependencies, consider auditing or re-resolving from a registry you trust (npmjs.org) to reduce supply-chain risk. - The index.js file appears to have sloppy code (a malformed spawn/Promise fragment), which suggests limited maintenance quality; consider reviewing the code or running it in a sandbox first. If you want to proceed: run in test mode first (--test), audit/replace the merchant key, ensure openclaw CLI is genuine, and preferably run inside an isolated environment until you are comfortable.

Type: OpenClaw Skill Name: blog-title-optimizer Version: 1.0.7 The skill bundle exhibits several high-risk indicators, most notably a suspicious 'package-lock.json' that references a non-existent version of the 'axios' library (1.13.6) and other dependencies from a specific mirror (mirrors.tencentyun.com), which is a common sign of a supply chain or dependency confusion attack. Furthermore, 'index.js' contains a syntax error (a stray backtick and comma) that would prevent the code from executing, and it hardcodes a merchant key for a mandatory pay-per-use payment system ('skillpay.me'). While these elements suggest deceptive or low-quality construction, there is no direct evidence of data exfiltration or backdoors in the provided source code.