Rn Skills

小红书爆款内容全自动创作助手，专注「时尚穿搭与新中式美学」赛道。 自动完成素材收集、选题筛选、文案生成、AI配图（通义万相）、本地归档的完整流程。 Use when: 用户说"创作小红书"、"收集素材"、"根据XXX创作"，或需要批量生成小红书图文笔记。 NOT for: 其他平台（抖音/微博）的内容创作，也不用...

This skill appears to do what it says (generate Xiaohongshu copy + images), but review and fix a few issues before running it: - Metadata omission: The registry metadata does not list the required DASHSCOPE_API_KEY even though SKILL.md and the script need it. Treat that as a packaging error and assume the API key is required. Do not provide the key unless you trust the source. - Inspect generate_images.py carefully: it will try to read ~/.zshrc to find DASHSCOPE_API_KEY if the env var is missing; if you do not want scripts scanning your shell config, set the env var explicitly or remove that fallback behavior. - Hard-coded paths: The script writes to absolute paths (/Users/yk/...). Modify the script to use relative or configurable output directories so it doesn't place files in unexpected locations or overwrite your data. - Shell execution risks: The script builds curl commands with the API key and runs them via shell=True. Ensure the API key and prompts are sanitized and run this in a controlled environment (or replace with requests library calls) to avoid injection risks. - Minimal credential scope: DASHSCOPE_API_KEY is the only credential used; verify you obtain the key from your own Alibaba account and rotate/revoke it if you stop using the skill. - Run in isolation first: Execute the script in a disposable environment (container or throwaway VM) to confirm behavior and to avoid accidental writes to your home directory. If you want, I can produce a safer variant of generate_images.py that (1) reads the API key only from an explicit env var, (2) uses relative output paths (or an explicit --output argument), and (3) uses Python HTTP requests instead of shell curl to avoid shell injection.

Type: OpenClaw Skill Name: rn-skills-tywx Version: 1.0.1 The script `generate_images.py` contains high-risk patterns, specifically reading the user's `~/.zshrc` file to extract API keys and using `subprocess.run(shell=True)` to execute `curl` commands, which introduces a shell injection vulnerability. While these behaviors are likely intended for the stated purpose of image generation via the DashScope API (dashscope.aliyuncs.com), the intrusive credential retrieval and insecure execution methods are significant security flaws. Additionally, the script contains hardcoded absolute paths specific to the author's environment, indicating poor portability and potential for unexpected behavior.