Convert GitHub repositories into RedNote (小红书) style technical articles. Use when user wants to generate tech promotion content from GitHub repos - including...

Before installing or running this skill: 1) Inspect raw files: open SKILL.md, manifest.yaml, and scripts/llm_generator.py and image_generator.py in a text editor that can show invisible/control characters. The pre-scan flagged possible system-prompt override and unicode-control characters in SKILL.md — remove or investigate any unexpected control characters or instructions that attempt to change agent/system prompts. 2) Confirm environment variable expectation: manifest.yaml and the code require a GITHUB_TOKEN. Do NOT provide a token with wide write/admin scopes. For public repo reads use a token with minimal scopes (public_repo or no repo write scopes). If you only need public repository metadata, prefer a token limited to read-only access. 3) Review network behavior in llm_generator.py: README claims 'no external LLM API keys required' and the code uses an OpenClaw agent client, but inspect llm_generator.py to ensure it does not call external LLM services (OpenAI/Anthropic/etc.) or unexpected endpoints. If it makes outbound network requests beyond api.github.com, evaluate whether those are necessary. 4) Check subprocess usage: image_generator.py imports subprocess and may invoke external converters (cairosvg or system binaries). Ensure it doesn't construct shell commands from untrusted input (e.g., repo README content) that could lead to command injection. 5) Sandbox and least privilege: run the tool in a sandboxed account or container first. Clear or inspect cache files under ~/.cache/github-to-rednote if concerned. Do not run with elevated privileges. 6) If you plan to use this skill autonomously, be extra cautious: prompt-injection indicators combined with autonomous invocation increase risk. If you cannot verify the SKILL.md and llm_generator contents, avoid granting it autonomous execution. If you want, I can: (a) search the included files for suspicious function calls or remote endpoints, (b) display the raw SKILL.md with visible-control-character highlighting, or (c) summarize llm_generator.py and any subprocess calls found in image_generator.py to help you decide.

Type: OpenClaw Skill Name: github-to-rednote Version: 1.6.0 The github-to-rednote skill bundle is a legitimate tool designed to convert GitHub repository information into formatted technical articles for the RedNote (Xiaohongshu) platform. It includes a robust GitHub API wrapper (github_api.py) with caching and rate-limit handling, a content generator (llm_generator.py) that utilizes OpenClaw's agent capabilities, and an image generation utility (image_generator.py) for creating cover images. The code follows safe practices, such as using list-based subprocess calls to avoid shell injection and properly encoding API parameters. No evidence of data exfiltration, malicious persistence, or harmful prompt injection was found; the skill operates entirely within its stated purpose.