ssai-dailymoments

松鼠Ai自习室·每日朋友圈运营助手。触发方式：用户说"朋友圈"时自动调用，自动生成5条不同朋友圈文案+手绘风格插画，图片以文件形式发送。支持定时推送（每日08:00/11:00/12:30/15:30/19:30），也可随时手动触发。

This skill claims to generate social-media copy and images and does that in its instructions, but it requires a MiniMax API Key (used in a Python snippet) while the package metadata does not declare any required credential — ask the author where you should store the API key and whether the skill will ever transmit history.json off your machine. Consider these before installing: 1) Do not paste your API key into third‑party UIs or code unless you trust the author and know how the key is stored; ask for a declared primaryEnv (e.g., MINIMAX_API_KEY) and a secure storage method. 2) Confirm where history.json is stored and whether you can enable retention limits or encryption — the skill permanently retains all generated content by default. 3) Verify the MiniMax API endpoint and that you want the image generation billed to your account. 4) If you need stricter privacy, request the skill be modified to declare required env vars and to provide an opt-in retention policy (or local-only ephemeral history). If author responses are not satisfactory, treat the skill as untrusted.

Type: OpenClaw Skill Name: ssai-dailymoments Version: 1.3.0 The skill automates the generation of social media posts and images for educational marketing. It is classified as suspicious because it explicitly instructs the AI agent to bypass the platform's built-in image generation tools in favor of executing a custom Python script that performs external network requests to the MiniMax API (api.minimaxi.com). While these actions are aligned with the stated purpose, the use of raw Python execution for API interactions and local file management (history.json) increases the attack surface and bypasses standard platform safety abstractions.