xiaohongshu card generator

当用户提及渲染 Markdown/文本 为小红书风格卡片 ,当用户提及"生成小红书卡片"、"md 转图片"、"制作卡片"、"小红书图文" .

This skill appears to do what it claims: convert local Markdown/MDX into themed PNG cards using Playwright. Before installing or running it: (1) review assets/templates for any embedded or unexpected data (base64 images), (2) run in a sandbox or VM the first time because setup.sh runs npm ci and Playwright will download packages and a Chromium binary, (3) prefer 'doctor' first to validate templates and Playwright, (4) note that remote image fetching (embedding external images) happens only when you enable --wechat-mode, so avoid that flag if you don't want the tool to make outbound HTTP requests, and (5) inspect package.json/package-lock.json if you need assurance about third-party dependencies. If you want extra caution, audit the code (already included) or run npm install with network monitoring / offline lockfile verification.

Type: OpenClaw Skill Name: nuomi-xhs-card Version: 1.0.0 The skill bundle is a Markdown/MDX to image renderer that utilizes high-risk execution patterns. Specifically, 'scripts/src/core/markdown.ts' uses the MDX 'evaluate' function, which allows for arbitrary JavaScript execution within the rendering process. Furthermore, 'scripts/src/core/structure.ts' implements remote image fetching via 'fetch', and the core rendering logic in 'scripts/src/core/render.ts' relies on a headless Playwright browser. While these features are aligned with the tool's stated purpose of rendering complex documents, they represent a significant attack surface for Remote Code Execution (RCE) and Server-Side Request Forgery (SSRF) if the agent processes untrusted input. No evidence of intentional malice or data exfiltration was detected.