Pinterest

Search and browse Pinterest pins, get pin details, and send actual images to the user via Telegram/messaging. Use when the user wants to find inspiration, search for images/ideas, or browse Pinterest content. Sends images directly, not just links.

This skill appears to implement Pinterest scraping and an optional OAuth-backed API, but there are a few things to check before installing: - The code and docs reference PINTEREST_ACCESS_TOKEN but the skill metadata does not declare any required environment variables — ask the publisher to declare PINTEREST_ACCESS_TOKEN as a required credential so you know when a secret is needed. - The included Python script will run pip install httpx at runtime (it performs a subprocess installation). That modifies the runtime environment and fetches code from PyPI; prefer an explicit install step in the manifest or vendor/lock dependencies so you can audit them before they’re installed. - The skill uses web scraping and instructs the agent to take snapshots/screenshots and send image files directly. That behavior is consistent with the stated purpose but increases privacy and copyright risk (it pulls and transmits image content from the web). Only enable it if you trust the skill owner and you’re comfortable with the agent fetching/sending external images. Recommendations: 1) Ask the author to update the manifest to declare PINTEREST_ACCESS_TOKEN (requires.env) and to list dependencies or provide an install spec instead of doing runtime pip installs. 2) Audit the included script (scripts/pinterest_api.py) in full before running it in a production or privileged environment. 3) If you supply an access token, use a dedicated, least-privilege token (only boards:read/pins:read if possible) and store it securely. 4) Consider limiting autonomous invocation for this skill until you’re comfortable with its behavior (or monitor its network activity). If the publisher cannot clarify these points, treat the skill with caution or classify it as untrusted.

Type: OpenClaw Skill Name: pinterest Version: 1.1.1 The skill is classified as suspicious due to the presence of risky capabilities, specifically the runtime installation of dependencies and extensive web scraping. The `scripts/pinterest_api.py` file uses `subprocess.check_call` to install the `httpx` library if it's not found, which, while for a legitimate library, represents a capability to execute arbitrary commands during runtime. Additionally, the script performs web scraping of `pinterest.com` using `httpx` and regex, involving arbitrary network requests and parsing untrusted HTML, which are inherently risky operations. While these actions are plausibly needed for the skill's stated purpose of searching and browsing Pinterest, they constitute 'risky capabilities without clear malicious intent' as per the provided guidelines.