Red book content creation

将文章、技术文档等内容转换为适合小红书发布的 HTML 格式，生成封面图和内容截图，配好标题和正文摘要。 用户提供原始内容（Markdown 或纯文本）后，AI 生成适配小红书风格的多图 HTML 页面，并调用截图工具生成可直接发布的图片。 适用于：技术博客分享、知识干货、產品介绍、营销内容等。

This skill appears to do what it says: generate styled HTML and create screenshots locally. Before installing/running: 1) ensure wkhtmltoimage and the Python imgkit dependency are installed and available on PATH (the tool depends on them); 2) review and test the scripts in a safe, writable workspace—generate_content.sh uses sed -i to replace placeholders and references unset variables (SUBTITLE, TAGS) which may yield empty fields or break on some systems (BSD sed vs GNU sed differences); 3) note the SKILL.md examples use an absolute /root path—adjust to your environment; 4) the screenshot script uses a fixed estimated content height and will create multiple chunk images—check outputs for completeness; 5) the skill runs locally and does not exfiltrate data, but avoid feeding it sensitive secrets since it will create files in the skill workspace. If you need further assurance, run the scripts on non-sensitive sample content and confirm behavior before using with real posts.

Type: OpenClaw Skill Name: red-book-content-creation Version: 1.0.1 The skill bundle is designed to convert text into social media-style HTML and images but contains a significant command/argument injection vulnerability in 'scripts/generate_content.sh'. The script uses 'sed' to replace placeholders with unsanitized user input, which can be exploited to manipulate the file system or cause script errors. Additionally, the use of 'imgkit' (wkhtmltoimage wrapper) in 'scripts/take_screenshot.py' presents a potential SSRF or local file inclusion risk if the generated HTML contains malicious references, though no clear evidence of intentional malice was found.