朋友圈4宫格卡片

输入主题方向，自动生成微信朋友圈文案+4张教程卡片图片

Do not install or run this skill unless you trust the author and understand the risks. Specific concerns: (1) the script contains a hard-coded third-party API key and will send your topics to https://api.minimaxi.com rather than using an OpenAI key you provide; this can leak prompts and any sensitive content you include; (2) required runtime dependencies (Playwright/Chromium, httpx/requests) are not declared — the skill may fail or trigger large automatic installs; (3) the SKILL.md is inaccurate about where the generation happens. Recommended actions before using: ask the author to remove the embedded API key and instead use a documented environment variable under your control; require explicit disclosure of the external service and its privacy policy; add an install spec or dependency list for Playwright/Chromium; or review and run the script in a sandboxed environment. If you cannot verify these changes, treat the skill as untrusted.

Type: OpenClaw Skill Name: moments-grid Version: 1.0.1 The skill is classified as suspicious due to several significant vulnerabilities in `scripts/generate.py`. It hardcodes a MiniMax API key, exposing a sensitive credential. Furthermore, the script is vulnerable to LLM prompt injection, as user input (`topic`) is directly embedded into the prompt sent to the MiniMax API. There is also a potential HTML/CSS injection vulnerability, as LLM-generated content is directly inserted into an HTML template rendered by Playwright, which could be exploited if the LLM generates malicious markup. While these are serious flaws, there is no clear evidence of intentional malicious behavior like data exfiltration or backdoor installation.