← 返回 Skills 市场

AI内容创作助手

Name: AI内容创作助手
Author: ryan-wuxl

作者 ryan-wuxl · GitHub ↗ · v1.0.0 · MIT-0

cross-platform ⚠ suspicious

128

总下载

当前安装

版本数

在 OpenClaw 中安装

/install ai-content-writer

功能描述

AI 智能写作助手 - 支持多平台内容创作，包括公众号、小红书、知乎、LinkedIn 等风格。提供 AI 查重、SEO 优化、改写润色等功能，一键生成高质量内容。

使用说明 (SKILL.md)

AI 智能写作助手

一站式 AI 内容创作工具，支持多平台风格，助你轻松产出爆款内容。

✨ 功能特点

📝 多平台风格 - 支持公众号、小红书、知乎、LinkedIn、Twitter 等
🎨 10+ 写作风格 - 专业、轻松、幽默、故事化等
🔍 AI 查重检测 - 检测内容原创度，避免重复
📈 SEO 优化 - 自动插入关键词，提升搜索排名
🔄 智能改写 - 一键改写、润色、扩写、缩写
⚡ 一键生成 - 输入主题，快速生成完整文章

🚀 使用方法

生成文章

# 公众号风格
node {baseDir}/scripts/write.mjs --topic "AI 投资趋势" --style wechat --tone professional

# 小红书风格
node {baseDir}/scripts/write.mjs --topic "理财小白入门" --style xiaohongshu --tone casual

# 知乎风格
node {baseDir}/scripts/write.mjs --topic "如何选股" --style zhihu --tone story

改写润色

node {baseDir}/scripts/rewrite.mjs --file ./article.md --style professional

SEO 优化

node {baseDir}/scripts/seo.mjs --file ./article.md --keywords "AI,投资,股票"

🎨 支持的平台风格

平台	风格特点
wechat	公众号 - 深度长文，逻辑清晰
xiaohongshu	小红书 - 短平快，emoji 多
zhihu	知乎 - 专业严谨，数据支撑
linkedin	LinkedIn - 职场专业，简洁有力
twitter	Twitter/X - 简短精悍，观点鲜明
weibo	微博 - 热点结合，互动性强
douyin	抖音 - 口语化，节奏快

📝 语气风格

professional - 专业严谨
casual - 轻松随意
humorous - 幽默风趣
story - 故事化叙述
persuasive - 说服力强
emotional - 情感共鸣

🔧 配置

需要设置 Tavily API Key（用于热点话题搜索）：

export TAVILY_API_KEY=your_api_key_here

📄 输出示例

# AI 投资新趋势：普通人如何抓住机会 🤖💰

> 本文 1500 字，阅读约 5 分钟

最近，AI 投资成为了热门话题...

## 为什么现在是入场时机？

...

---

*本文由 AI 智能写作助手生成*

License

MIT

安全使用建议

This skill mostly does what it claims, but there are several red flags to review before installing or running it: 1) The bundled write.mjs invokes an external script at ~/.openclaw/skills/tavily-search/scripts/search.mjs — ensure that file exists and is from a trusted source (inspect it). 2) The README/SKILL.md mention rewrite.mjs and seo.mjs but those files are not included; confirm the package is complete. 3) write.mjs runs a shell command via execSync and interpolates the topic into the command string; maliciously crafted topics could lead to shell injection — avoid running with untrusted input or run in a restricted sandbox. 4) The skill passes your TAVILY_API_KEY to the external script — limit the key's scope if possible and only provide it if you trust the tavily-search implementation. 5) If you cannot inspect the referenced tavily-search script or verify the repository origin, run the skill in an isolated environment (container/VM) or reject installation. Reviewing the missing helper scripts and the external tavily-search script would likely change this assessment to benign if they are legitimate and safe.

功能分析

Type: OpenClaw Skill Name: ai-content-writer Version: 1.0.0 The skill contains a command injection vulnerability in `scripts/write.mjs` within the `searchHotTopics` function, where the user-provided `topic` argument is passed unsanitized to `execSync`. It also attempts to execute a script located in a specific hardcoded path within the user's home directory (`~/.openclaw/skills/tavily-search/scripts/search.mjs`). While these behaviors pose a significant security risk (RCE), they appear to be poorly implemented functional requirements for inter-skill communication rather than intentional malware.

能力评估

ℹ Purpose & Capability

Name/description ask for hot-topic search and content generation; requiring node and a Tavily API key is coherent. However, the runtime code execs a script at ~/.openclaw/skills/tavily-search/scripts/search.mjs — this implies a dependency on a separate local 'tavily-search' skill that is not declared in metadata or SKILL.md. That implicit dependency is unexpected and deserves explanation.

⚠ Instruction Scope

SKILL.md describes only write/rewrite/seo workflows, but only write.mjs is bundled; rewrite.mjs and seo.mjs are referenced but missing. The bundled write.mjs uses child_process.execSync to run a node script located under the user's HOME .openclaw/skills path (an external script) and constructs a shell command including the user-provided topic. Executing another skill's script and building shell commands from user input create real risks (unexpected code execution and shell injection).

✓ Install Mechanism

No install spec (instruction-only plus included script) — lowest install risk. Nothing is downloaded from remote URLs or installed automatically by this package.

ℹ Credentials

Only TAVILY_API_KEY is required and is justified by the advertised '热点搜索' feature. The script also depends on standard env like HOME and deliberately passes TAVILY_API_KEY into the subprocess. This is plausible, but the skill will hand that API key to an external script (tavily-search) that is not part of this package — review that script before granting the key.

✓ Persistence & Privilege

always is false; the skill does not request elevated or persistent system-wide privileges in its manifest. It does execute code from another skill's directory but does not appear to modify other skills or system configuration.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install ai-content-writer
安装完成后，直接呼叫该 Skill 的名称或使用 /ai-content-writer 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v1.0.0

Initial release: Multi-platform content creation for social media

元数据

Slug ai-content-writer

版本 1.0.0

许可证 MIT-0

累计安装 0

当前安装数 0

历史版本数 1

常见问题