Skills newsletter-curation
📦

newsletter-curation

Content revision r1 Critical ⚙️ External commands🌐 Network access

Create Curated Newsletter Issues

Teams need a repeatable way to turn scattered sources into useful newsletter issues. This skill helps Claude, Codex, and Claude Code plan formats, source topics, write commentary, and improve growth habits.

Supports: Claude Codex Code(CC)
⚠️ 38 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "newsletter-curation" from https://skillstore.io/skills/inference-sh-9-newsletter-curation.md and its manifest at https://skillstore.io/api/skills/inference-sh-9-newsletter-curation/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/inference-sh-9-newsletter-curation.md Signed manifest GET /api/skills/inference-sh-9-newsletter-curation/manifest Signed lockfile GET /api/skills/inference-sh-9-newsletter-curation/lockfile

Test it

Using "newsletter-curation". A weekly AI newsletter for product managers needs a clear issue structure.

Expected outcome:

  • Opening note: two sentences on the week in AI product work.
  • Big story: one launch or policy change with practical product impact.
  • Worth reading: five curated links with short editorial commentary.
  • Quick hits: three brief updates for scanning readers.
  • Closing: one question that invites replies from subscribers.

Using "newsletter-curation". A founder wants better commentary for a link about pricing research.

Expected outcome:

This piece matters because it connects pricing experiments to customer trust. I would highlight the research method, the strongest finding, and one practical test readers can run this week.

Using "newsletter-curation". An editorial team needs subject line ideas for a developer tools digest.

Expected outcome:

  • #18: The build tool shift hiding in plain sight
  • 5 developer tools worth testing this week
  • This week in dev tools: faster builds, fewer tabs
  • The migration guide teams keep asking for

Security Audit

Critical
v4 • 7/5/2026 Open versioned report

Most backtick-related static findings are false positives from Markdown fences and inline formatting. The remote installer command on SKILL.md line 14 is a confirmed critical pipe-to-shell risk, and several infsh command examples create real external service exposure.

1
Files scanned
294
Lines analyzed
6
Review items
0
False positives ignored

Confirmed security concerns (2)

Critical
SKILL.md:14
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh && infsh login
The command curl -fsSL https://cli.inference.sh | sh pipes remote content directly into a shell. This is a critical unsafe install pattern for marketplace publication.
High
SKILL.md:4SKILL.md:140-158SKILL.md:253-257
Broad External CLI Permission
The manifest allows Bash(infsh *), and the skill asks users to run infsh app commands against search, image, and social posting services. This can send prompts and newsletter content to external services or trigger hosted actions.
The allowed-tools declaration explicitly grants infsh command execution, and later examples use remote search and posting apps. The behavior appears intentional but creates clear external service exposure.
Capability review items (6)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Critical
SKILL.md:14
Hardcoded URL
curl -fsSL https://cli.inference.sh | sh && infsh login
The hardcoded URL is used in a curl command piped directly to sh. This executes remotely downloaded installer content and creates a supply-chain execution risk.
High
SKILL.md:13-25
Ruby/shell backtick execution
```bash
This bash block instructs users to run a remote installer and infsh app commands. The commands can execute downloaded code and send newsletter inputs to external services.
Medium
SKILL.md:140-160
Ruby/shell backtick execution
```bash
This bash block instructs use of infsh app run commands for Tavily and Exa searches. Those commands call external services and can disclose query context.
Medium
SKILL.md:253-258
Ruby/shell backtick execution
```bash
This bash block invokes infsh app run x/post-create with social post text. It can trigger an external publishing workflow and should require explicit user approval.
Medium
SKILL.md:287-291
Ruby/shell backtick execution
```bash
This bash block recommends npx skills add commands for related skills. Running package-manager style commands from documentation can install additional third-party content.
Low
SKILL.md:27
Hardcoded URL
> **Install note:** The [install script](https://cli.inference.sh) only detects your OS/architecture
The line documents remote installer and checksum URLs tied to the install flow. It is a legitimate network dependency, but it still relies on external distribution infrastructure.

Risk Factors

⚙️ External commands (21)
SKILL.md:13-25 SKILL.md:25-27 SKILL.md:27-35 SKILL.md:35-45 SKILL.md:45-51 SKILL.md:51-61 SKILL.md:61-67 SKILL.md:67-76 SKILL.md:76-90 SKILL.md:90-134 SKILL.md:134-140 SKILL.md:140-160 SKILL.md:160-189 SKILL.md:189-202 SKILL.md:202-206 SKILL.md:206-208 SKILL.md:208-253 SKILL.md:253-258 SKILL.md:258-287 SKILL.md:287-291 SKILL.md:291-293
🌐 Network access (3)
SKILL.md:9 SKILL.md:14 SKILL.md:27

Detected Patterns

Pipe to shell pattern
Audited by: codex View Audit History →
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/inference-sh-9-newsletter-curation/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/inference-sh-9-newsletter-curation/security.svg)](https://skillstore.io/skills/inference-sh-9-newsletter-curation?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/inference-sh-9-newsletter-curation?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/inference-sh-9-newsletter-curation/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/inference-sh-9-newsletter-curation.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA · BibTeX · CFF)

APA citation

inference-sh-9. (2026). newsletter-curation security audit report (audit version 4) [Author version unspecified]. Skillstore. https://skillstore.io/skills/inference-sh-9-newsletter-curation/audits/4

BibTeX citation

@techreport{inference-sh-9-inference-sh-9-newsletter-curation-2026, author = {inference-sh-9}, title = {newsletter-curation security audit report (audit version 4)}, institution = {Skillstore}, year = {2026}, number = {4}, url = {https://skillstore.io/skills/inference-sh-9-newsletter-curation/audits/4}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "newsletter-curation security audit report (audit version 4)" version: "unspecified" type: report authors: - name: "inference-sh-9" date-released: "2026-07-05" url: "https://skillstore.io/skills/inference-sh-9-newsletter-curation/audits/4" identifiers: - type: other value: "skillstore:inference-sh-9-newsletter-curation:audit:4" description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium
55
Architecture
85
Maintainability
87
Content
70
Community
83
Spec Compliance

What You Can Build

Plan a Weekly Industry Digest

Build a repeatable issue structure with curated links, short commentary, and a consistent send schedule.

Develop a Creator Newsletter

Turn personal expertise into a focused issue with an essay, selected links, and a clear reader call to action.

Standardize Editorial Curation

Create source filters, commentary rules, subject line patterns, and quality checks for a team newsletter.

Try These Prompts

Draft a Simple Link Roundup 
Create a weekly link roundup for [audience] about [topic]. Include five source slots, a short introduction, commentary prompts, and a clear closing call to action.
Plan a Full Weekly Issue 
Plan issue #[number] for [newsletter name]. Include a big story, worth reading section, quick hits, stat of the week, subject lines, and a send cadence recommendation.
Improve Curated Commentary 
Review these candidate sources for [audience]. Select the strongest items, explain why each matters, and write concise commentary with my editorial point of view.
Design Growth and Measurement 
Create a six-week newsletter growth plan for [newsletter]. Include distribution channels, referral ideas, archive strategy, engagement prompts, and metrics to monitor after each issue.

Best Practices

  • Verify each source before writing commentary or recommending it to readers.
  • Keep each issue focused on the reader value promised by the subject line.
  • Use a consistent send cadence and review performance after every issue.

Avoid

  • Sending long lists of links without editorial context.
  • Publishing AI-written summaries without checking source accuracy.
  • Running external posting commands before the user approves final copy.

Frequently Asked Questions

What does this skill help create?
It helps create curated email newsletter issues, link roundups, commentary sections, subject lines, and growth plans.
Can it find current sources?
It includes example prompts for external search apps. Current source gathering depends on available tools and user approval.
Does it send email campaigns?
No. It helps plan and draft newsletter content, but it does not manage lists or send campaigns.
Can it help with subscriber growth?
Yes. It provides growth tactics such as cross-promotion, social distribution, referral programs, archives, and lead magnets.
Is external publishing automatic?
No. Any social posting or external publishing command should require final user review and explicit approval.
Which AI tools can use this skill?
The report lists support for Claude, Codex, and Claude Code.

Developer Details

License

MIT

Skillstore revision

r1

Version notice

The author did not declare a version.

Repository

https://github.com/inference-sh-9/skills/tree/main/skills/newsletter-curation/

Ref

a25199bc7d6b82598536822d1738eb5d5f54025b

Maintenance freshness

7/23/2026

Usage

5 downloads · 171 views

File structure

📄 SKILL.md