Analyzes websites to generate multi-language content strategy, keyword research, and competitor analysis. Use when user provides a URL and needs industry ana...

Before installing or running this skill, consider the following: - Clarify how the 'AI analysis' step is implemented: does it call an external 'Opencode AI' API? If so, ask the author for the endpoint and which credentials (API key) are required and why. The skill currently does not declare any env vars for that, which is an incoherence. - Review the two included scripts yourself. They are small and straightforward: crawl_website.py issues an HTTP GET to the target URL and saves a JSON, generate_excel.py reads local JSON and writes an Excel file. There is no hidden network exfiltration in the scripts as provided. - Note the crawler does not respect robots.txt or perform rate limiting. If you plan to crawl third-party sites, ensure you have permission and run it responsibly (or modify the script to check robots.txt and throttle requests). - Because the SKILL.md is vague about how keyword and competitor analysis are generated, confirm whether the agent will use your account/model (and any associated billing) or call an external API. If the agent will call an external service, restrict or inspect outbound network access and do not provide secrets until you verify the service. - If you will run this skill in a shared environment, consider executing it inside a sandbox/container and inspecting network traffic to confirm no unexpected endpoints are contacted. - If you need the full promised feature (multi-country AI-driven competitor analysis), request that the skill author either include the integration code (with secure credential handling) or update the documentation to explain how the AI analysis step is performed.

Type: OpenClaw Skill Name: content-strategy-analyzer Version: 1.0.0 The skill is classified as suspicious due to significant vulnerabilities in its scripts. `scripts/crawl_website.py` is vulnerable to Server-Side Request Forgery (SSRF) as it fetches content from an arbitrary user-supplied URL without validation, potentially allowing access to internal network resources. `scripts/generate_excel.py` is vulnerable to path traversal, as it accepts arbitrary file paths for both input and output files via command-line arguments, which could lead to unauthorized reading or writing of files on the system.