Generate platform-tuned social media captions for photography. Use when a user shares a photo and wants captions for posting. Triggers on sharing photos with...
Security Analysis
high confidenceThis is an instruction-only caption-generation skill whose requirements, instructions, and absence of installs/credentials are consistent with its stated purpose.
Name and description match the content of SKILL.md: the skill instructs the agent to produce platform-specific captions for photos. It requests no binaries, env vars, or credentials—reasonable for a purely text-generation helper.
SKILL.md contains detailed, platform-specific caption templates and constraints. It does not instruct the agent to read unrelated files, access system configs, call external endpoints, or exfiltrate data. The guidance to include gear only when provided and not to fabricate details is appropriate.
No install spec and no code files are present (instruction-only). This minimizes disk writes and arbitrary code execution risk. README shows a clawhub install command for convenience, but registry metadata indicates no install artifacts in the package itself.
The skill declares no required environment variables, credentials, or config paths. That is proportionate for a caption-generation helper that only needs user-supplied photo context.
always is false and the skill does not request persistent or elevated privileges. It does not attempt to modify other skills or system-wide settings. Autonomous invocation is allowed by default (platform normal), but there are no additional persistence mechanisms.
Guidance
This skill appears to be what it claims: an instruction-only caption writer with no external installs or requested secrets. Consider the following before enabling: (1) privacy — captions will be generated from whatever photo/context you share, so avoid including sensitive personal details or precise private locations if you don't want them used; (2) model privacy — the agent will send prompts (and possibly image/meta context) to whatever model/service your agent uses, so review that provider's data handling; (3) triggers — confirm when and how the skill is invoked (automatic on photo share vs. user-initiated) to avoid unexpected behavior. If you need stronger guarantees, ask the skill author for a clear privacy statement or opt for manual invocation only.
Latest Release
v1.2.3
Removed Apple Notes logging: eliminated hidden script execution, potential shell injection via AI-generated args, and undisclosed background agent activity
More by @pfrederiksen
Published by @pfrederiksen on ClawHub
