market-kit-skills

Use when the user needs marketing deliverables such as campaign plans, Xiaohongshu notes, audience positioning, selling-point refinement, reference-grounded...

This skill does implement the marketing functionality it advertises, but it also expects a JustAI API key and will read and write configuration in your home directory (shell rc files like ~/.zshrc or ~/.bashrc and local JSON config files) and contacts justailab.com. The registry metadata does not declare those environment variables or config writes — that's the main mismatch and risk. Before installing: (1) only install if you trust the justailab endpoint and the skill author; (2) review scripts/_common.py (persist_api_key, _candidate_config_paths, and network request code) to understand exactly what will be read/written and when auto-login runs; (3) prefer running these scripts in an isolated environment (throwaway account, container, or VM) if you need to test; (4) if you will use it on a real account, prepare to provide an API key explicitly and verify the skill will not overwrite unrelated shell rc entries; and (5) ask the maintainer to update metadata to declare required env vars and to document explicitly that the tool may write your shell rc and local config files.

Type: OpenClaw Skill Name: market-kit-skills Version: 1.0.0 The skill bundle includes scripts (primarily _common.py) that modify the user's shell configuration files (~/.zshrc, ~/.bashrc, and ~/.profile) to persist API keys and configuration for the 'justailab.com' service. While this is a functional requirement for the tool's login flow, modifying shell startup scripts is a high-risk persistence mechanism. The bundle also includes comprehensive unit tests (test_login_flow.py) that confirm this behavior. No evidence of intentional malice or data exfiltration was found, but the intrusive nature of the environment modification warrants a suspicious classification.