Cowork Plugin: AI marketing department for contractors and home service businesses. 12 slash commands + 6 background skills for SEO, ads, social media, propo...

What to consider before installing: - Embedded external API call: SKILL.md contains a curl to a Supabase project (dmlybcnpwtnaadmapdhl.supabase.co) with an apikey parameter in clear text. Ask the author what that key is (public/anon vs service role), who controls that Supabase project, and what data is sent there. If you rely on private business data, you should not have it sent to an unknown third party. - Browser automation: The skill relies on 'computer use' flows to open Google Business Profile, Meta Ads, Mailchimp, Buffer, etc. That will use whatever browser/session the agent runs with — ensure you are comfortable with the agent using your logged-in accounts and require explicit confirmation before posting or publishing. - Local profile file: The plugin saves business-profile.md and other outputs in the current directory. Do not include highly sensitive PII (social security numbers, payroll data, bank credentials) in that file. Store it in a location you control and review its contents. - Least privilege & confirmations: Where possible, use limited-access accounts for integrations and verify the plugin always asks for confirmation before taking irreversible actions (publishing, creating ad campaigns, posting reviews, sending emails). - Ask for changes: Prefer the API key be removed from SKILL.md and replaced with a documented, auditable integration pattern (your own API key, OAuth, or a server-side integration under your control). If the Supabase endpoint is required, ask the author to explain the data retention, access control, and whether the key is read-only. - Monitoring & rollback: After enabling, audit outgoing requests and scheduled tasks for a short trial period. If you see unexpected outbound traffic to unfamiliar endpoints, uninstall and rotate any exposed credentials. Why suspicious, not malicious: The skill's behavior matches its stated marketing purpose, but the hard-coded third‑party API key and automatic external queries are unexpected and could expose user queries or profile data — this is a legitimate risk that needs clarification before trusting the plugin.

Type: OpenClaw Skill Name: contractor-marketing-cowork Version: 1.0.0 The skill bundle is a comprehensive marketing automation tool for contractors, designed to manage SEO, ads, and social media. It utilizes OpenClaw's 'computer use' capabilities for browser automation on platforms like Meta Ads and Google Business Profile, but includes safety instructions to 'pause and confirm' with the user before publishing. A hardcoded Supabase API key in SKILL.md is used to fetch legitimate marketing strategy data from the developer's endpoint (dmlybcnpwtnaadmapdhl.supabase.co), and no evidence of data exfiltration or malicious prompt injection was found.