social-media-title-insight

Analyze social media post titles to discover what makes content perform well. Use when user uploads data (Excel, CSV, JSON, text) with titles and engagement...

This skill appears to implement the advertised title-analysis workflow, but exercise caution: (1) The bundled script will contact an external service (tezign.com) when you use the account-preview mode — confirm you are comfortable sending account names and any other data. (2) SKILL.md and the code disagree on which endpoint and tenant ID are used; ask the publisher which endpoint is correct and what data the API receives and returns. (3) The HTML-to-PDF script requires Playwright (not documented in SKILL.md); run in an isolated environment or container and inspect/ pin dependency installs before running. (4) If you will analyze sensitive or private content, prefer using the local-file workflow (preview/auto with local input) and avoid the API mode until you verify the remote service's privacy policy and data handling. (5) Consider opening the full data_tool.py (complete file) and reviewing exactly what is POSTed to remote endpoints, and run the script with network access disabled if you want to guarantee no outbound calls.

Type: OpenClaw Skill Name: social-media-title-insight Version: 1.0.0 The skill bundle provides a social media analysis tool that interacts with a third-party API (tezign.com) and processes local data files. A significant security risk is present in `scripts/data_tool.py` within the `compute` command, which uses `pandas.eval()` on user-provided expressions, creating a potential Remote Code Execution (RCE) vulnerability. Additionally, the `SKILL.md` instructions suggest using `pbpaste` to ingest data, which is a high-risk behavior as it allows the agent to access potentially sensitive clipboard content. While these appear to be risky design choices or vulnerabilities rather than intentional malware, they pose a threat to the host environment.