文章风格克隆助手

提供1-5篇参考文章 + 原始素材，AI 分析参考文章的风格特征， 将素材改写成同风格的成品文章，输出3个版本供选择，支持强度调节和迭代优化。

Before installing or using this skill: - Expect your reference articles and draft to be sent to an external LLM service; do not submit sensitive or confidential text. - The skill's metadata does NOT list required API keys, but the script requires OPENAI_API_KEY or DEEPSEEK_API_KEY — confirm which key you must provide and whether you trust the target endpoint (default https://api.deepseek.com). - If you prefer a specific provider (e.g., OpenAI), set OPENAI_API_BASE and OPENAI_API_KEY and test with non-sensitive content first. - Review scripts/clone_style.py yourself (or with a security-savvy person) to confirm there are no hidden endpoints or unexpected behavior; the code appears straightforward but the default endpoint may be unfamiliar. - Consider whether cloning a living author's style raises copyright or ethical concerns in your use case. If you need higher assurance, ask the skill author to update registry metadata to declare required env vars and to document the default API provider and its privacy policy.

Type: OpenClaw Skill Name: style-cloner Version: 1.0.0 The skill contains a vulnerability in `scripts/clone_style.py` where the `read_input` function automatically reads the contents of any valid file path provided in the input arguments. This allows for arbitrary local file disclosure if an attacker or a malicious prompt tricks the agent into passing sensitive system paths (e.g., configuration files or SSH keys) as 'reference articles,' which are then exfiltrated to an external LLM API (defaulting to `api.deepseek.com`). While this behavior appears to be a risky design choice for CLI convenience rather than intentional malware, it poses a significant security risk in an agentic environment.