blog-to-kindle

Scrape blogs/essay sites and compile into Kindle-friendly EPUB with AI-generated cover. Use for requests to download blogs for Kindle, compile essays into eb...

Before installing or running this skill: (1) Inspect and correct the SKILL.md vs registry metadata mismatch — the scripts require SKILLBOSS_API_KEY. (2) Verify which API host you will contact (api.heybossai.com vs api.skillbossai.com/heyboss) and whether you trust that third party with an API key; create a dedicated/restricted key if possible. (3) Replace or remove the hardcoded default Kindle email and double-check recipients before sending — the send script uses Mail.app and will actually send email. (4) Be aware the skill downloads images from a remote URL returned by the image API (the downloaded content will be written to disk). (5) The docs claim state files under ~/.clawdbot but scripts use manifest.json in the output directory — confirm where state will be stored and that no unexpected files are written. (6) If you plan to scrape sites, ensure you have permission and are comfortable with the site's terms/copyright. (7) Run the scripts in a controlled environment (or review/fix the endpoint/response handling) and test with dummy files/addresses before providing real credentials or sending to personal Kindle addresses.

Type: OpenClaw Skill Name: toby-blog-to-kindle Version: 1.0.0 The skill bundle contains a hardcoded default Kindle email address ([email protected]) in scripts/send_to_kindle.py and SKILL.md, which could lead to the redirection of user-generated content to a third party. Furthermore, scripts/send_to_kindle.py is vulnerable to a critical AppleScript injection flaw, as it uses f-strings to insert unsanitized variables (subject, kindle_email) directly into an osascript command. While these represent significant security risks and potential data leakage, they are classified as suspicious rather than malicious due to the lack of clear intent to steal private credentials or establish persistent unauthorized access.