Product Hunt Launch

Product Hunt launch optimization with specific specs, timing, and gallery strategy. Covers taglines, gallery images, maker comments, and launch day tactics....

This skill appears to do what it says (help with Product Hunt launches) but it asks you to install and log into an external CLI (inference.sh) by piping a remote script to sh and to use that service to generate/upload images and run research. Before installing/using it: (1) do not blindly run `curl | sh` — instead download the installer, verify the SHA‑256 checksum from the same verified source, and inspect the script. (2) Expect to create accounts or API keys for inference.sh/falai/tavily; treat those credentials carefully and do not reuse high-privilege keys. (3) Understand that running the CLI may upload local images or product copy to third-party servers — review the service's privacy/terms. (4) Prefer installing in a sandbox/VM if you want to test. (5) Ask the skill author to explicitly list required environment variables and clarify what the installer does; lack of those declarations is why this is rated 'suspicious.' If those issues are addressed (explicit credential listing, safer install instructions, clear privacy/usage notes), reassess to a lower risk level.

Type: OpenClaw Skill Name: product-hunt-launch-2 Version: 0.1.5 The skill bundle instructs the AI agent to execute `curl -fsSL https://cli.inference.sh | sh` in `SKILL.md`. This command downloads and executes a shell script from a remote server, which is a common vector for Remote Code Execution (RCE) and supply chain attacks. While the `SKILL.md` attempts to explain the script's safety, this method inherently introduces a significant vulnerability, classifying the skill as suspicious due to this risky capability, even without clear evidence of intentional malicious behavior.