WotoHub Automation

End-to-end WotoHub influencer outreach automation for product understanding, creator search, recommendation ranking, outreach email drafting, batch send, inb...

Before installing or providing credentials, consider these steps: - Review requirements.txt and audit third-party packages before pip installing; run in an isolated virtualenv or sandbox. - Inspect SKILL.md for invisible/control characters (the scan flagged unicode-control-chars) and remove or re-fetch the file from a trusted source if unclear. - Verify the scope of WOTOHUB_API_KEY (use a limited/test API key with minimum permissions) and never use high-privilege production keys during initial testing. - Test preflight (python3 scripts/preflight.py --token YOUR_TEST_KEY) with an invalid/limited key to confirm what endpoints are hit and what the skill can access. - Search the codebase for outbound network calls and confirm they go to legitimate WotoHub endpoints (references point to https://api.wotohub.com/api-gateway). If you must change the base URL, use WOTOHUB_BASE_URL to point to a test environment. - Note the skill can request/expect 'hostAnalysis' via host-bridge executors; if you run it inside a host that supplies model/context, be aware it may request or accept host-injected structured data. Ensure those host bridges are trusted and validated before allowing automated sends or auto-replies. If you want, I can list the top files and code locations that perform network sends and inbox access so you can review the exact HTTP calls the skill makes.

Type: OpenClaw Skill Name: wotohub-automation Version: 1.0.8 The skill bundle implements a powerful 'executor' pattern in scripts like `api_campaign_runner.py` and `orchestrator.py` that allows for the execution of arbitrary shell commands via environment variables (e.g., `WOTOHUB_HOST_ANALYSIS_EXECUTOR`) or configuration objects. While this is intended for extensibility (connecting external models or browser tools), the use of `subprocess.run` with `shlex.split` on formatted strings presents a significant risk for command injection. Additionally, `api_task_runner.py` contains logic to programmatically schedule tasks using the `openclaw cron` CLI, which provides a mechanism for persistence. Although these features are aligned with the stated purpose of campaign automation, the high-privilege execution capabilities and lack of strict command sanitization make the bundle suspicious.