← 返回 Skills 市场

LinkedIn Post Generator

Name: LinkedIn Post Generator
Author: icepopma

作者 icepopma · GitHub ↗ · v1.0.7

cross-platform ⚠ suspicious

371

总下载

当前安装

版本数

在 OpenClaw 中安装

/install linkedin-post-generator

功能描述

AI-powered LinkedIn post generator for professionals. Create engaging posts, thought leadership content, and career updates using Sloan agent.

使用说明 (SKILL.md)

LinkedIn Post Generator

Generate professional LinkedIn posts that drive engagement. Perfect for professionals, thought leaders, and job seekers.

Features

Professional Tone - Industry-appropriate language
Engagement Hooks - Attention-grabbing openings
Multiple Types - General, thought-leadership, celebration, announcement
Call-to-Action - Drive comments and shares

Usage

# Generate a LinkedIn post
linkedin-post-generator "career growth tips"

# Generate a thought leadership post
linkedin-post-generator "AI trends" --type thought-leadership

# Generate a celebration post
linkedin-post-generator "got promoted" --type celebration

Options

Option	Description	Default
`--tone`	Tone (professional, casual, inspiring)	professional
`--type`	Post type (general, thought-leadership, celebration, announcement)	general
`--no-emoji`	Disable emojis	-
`--no-hashtags`	Disable hashtags	-

Pricing

Pay per use: 0.002 USDT per generation

Environment Variables

Variable	Description	Required
`SKILLPAY_MERCHANT_KEY`	Payment merchant key (optional, embedded key used by default)	No
`OPENCLAW_GATEWAY_TOKEN`	Gateway auth token for local API fallback	No

Requirements

OpenClaw with Sloan agent (AI columnist)
OpenClaw Gateway running locally (for API fallback)

About Sloan

Sloan is your AI columnist - a professional content creator specializing in LinkedIn thought leadership and professional storytelling.

Support

GitHub: https://github.com/icepopma/linkedin-post-generator
Discord: https://discord.gg/clawd
Email: [email protected]

License

MIT © Matt

安全使用建议

This skill appears to do what it says (generate LinkedIn posts) but has red flags you should consider before installing: (1) it contains a hardcoded SKILLPAY merchant key — by default payments will go to that embedded account; if you will be charged, verify who controls that merchant and prefer setting your own SKILLPAY_MERCHANT_KEY or using test mode. (2) The code spawns the local 'openclaw' CLI and can call a local gateway with an Authorization token — do not provide a production OPENCLAW_GATEWAY_TOKEN unless you trust the author and have audited the code. (3) package-lock contains non-standard registry mirrors (mirrors.tencentyun.com) — review dependencies and consider installing in an isolated/sandboxed environment. (4) There is a formatting/possible bug around the spawn call in index.js; ask the author to confirm/clean the code and publish a repository/homepage you can inspect. If you don't trust the merchant or author, do not install on systems with sensitive tokens or real billing credentials; request the author remove embedded secrets and document how payments are handled, or run the skill locally with test mode and your own merchant key.

功能分析

Type: OpenClaw Skill Name: linkedin-post-generator Version: 1.0.7 The skill is a LinkedIn post generator that interfaces with the OpenClaw 'sloan' agent and the 'skillpay.me' payment gateway. Analysis of index.js and SKILL.md shows the code is aligned with its stated purpose, with no evidence of data exfiltration, malicious execution, or harmful prompt injection. While index.js contains a syntax error in the callSloanAgent function (a stray backtick and misplaced options object) and includes a hardcoded merchant secret key as a default, these appear to be unintentional development flaws rather than intentional malware.

能力评估

ℹ Purpose & Capability

Name/description, CLI usage and network calls (to a payment API and local OpenClaw gateway) are consistent with a pay-per-use post generator. However the code embeds a hardcoded merchant key (CONFIG.merchant_key) that will be used by default for billing — this is unexpected and not justified by the skill's description. The package-lock also references a non-standard mirror (mirrors.tencentyun.com), which is unusual though possibly benign.

ℹ Instruction Scope

SKILL.md instructs only normal CLI usage and documents optional SKILLPAY_MERCHANT_KEY and OPENCLAW_GATEWAY_TOKEN. The runtime code follows these instructions (calls an agent via the 'openclaw' CLI or local HTTP gateway). It does not read unrelated system files or request unrelated credentials. A practical concern: the skill will spawn a local process ('openclaw'), which executes commands on the host — expected for invoking a local agent but worth noting. Also the index.js contains a suspicious-looking snippet/formatting around the spawn call (a stray backtick/argument placement) that may indicate a bug or mistranscription; that could cause unexpected behavior.

✓ Install Mechanism

There is no install script/remote download; this is an instruction-and-code skill bundled with its source. No arbitrary remote downloads or extract operations are present in the manifest. The only oddity is the package-lock entries resolved from mirrors.tencentyun.com rather than the default registry, which is noteworthy but not necessarily malicious.

⚠ Credentials

The registry metadata declares no required env vars, while SKILL.md and the code reference two optional env vars: SKILLPAY_MERCHANT_KEY and OPENCLAW_GATEWAY_TOKEN — these are plausible. The concern is the hardcoded merchant key (sk_91fff75ae...) in CONFIG.merchant_key: by default payments will be routed to that embedded key/merchant, which is unexpected and raises privacy/monetary concerns. OPENCLAW_GATEWAY_TOKEN (if provided) is used as an Authorization header to localhost — supplying a production token to this skill could leak or misuse that token.

✓ Persistence & Privilege

The skill does not request persistent or elevated platform privileges (always:false). It does spawn the local 'openclaw' CLI and may call a local gateway endpoint, which is within the scope of invoking a local agent. It does not modify other skill configurations or claim system-level modifications.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install linkedin-post-generator
安装完成后，直接呼叫该 Skill 的名称或使用 /linkedin-post-generator 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v1.0.7

Security fix: Move merchant_key to code, remove from SKILL.md to avoid false positive

v1.0.6

Fix: Add merchant_key, clarify payment goes to publisher

v1.0.5

Remove hardcoded merchant_key, require user to set SKILLPAY_MERCHANT_KEY env var

v1.0.4

Add merchant key for payments

v1.1.1

- Internal maintenance update without user-facing changes - Updated dependencies in package.json - No modifications to documentation or features

v1.1.0

- Update version to 1.1.0 in package.json.

v1.0.3

- Added documentation for environment variables (`SKILLPAY_MERCHANT_KEY`, `OPENCLAW_GATEWAY_TOKEN`) in SKILL.md. - No changes to core functionality; documentation update only.

v1.0.2

- Added requirement for OpenClaw Gateway to run locally for API fallback. - Updated payment information to note use of an embedded merchant key. - No changes to features, options, or pricing.

v1.0.1

- Added new supported post types: announcement, in addition to general, thought-leadership, and celebration. - Introduced CLI options for tone, type, disabling emojis, and disabling hashtags. - Expanded documentation with an "Options" section and detailed usage instructions. - Added support, about, and license sections for better user information and contact.

v1.0.0

- Initial release of the LinkedIn Post Generator skill. - Generate professional posts for LinkedIn, tailored to various scenarios (career tips, thought leadership, celebrations). - Features include professional tone, engagement hooks, thought leadership positioning, and calls-to-action. - Requires OpenClaw with Sloan agent and SkillPay for pay-per-use billing (0.002 USDT per generation).

元数据

Slug linkedin-post-generator

版本 1.0.7

许可证 —

累计安装 1

当前安装数 1

历史版本数 10

常见问题