Xhs Cover Skill

生成小红书风格封面图片。使用场景：(1) 用户要求生成小红书封面 (2) 用户要求生成社交媒体封面图 (3) 用户为笔记/文章生成配图 (4) 用户询问 credit 余额或生成历史。首次使用会自动引导注册。

What to consider before installing/using this skill: - The skill runs a third‑party npm CLI (npx xhscover) which will download and execute code from the npm registry at runtime. This is expected for a CLI but means remote code runs on your machine — inspect the npm package and GitHub repo first. - Using the skill will send your API Key and the cover text you provide to api.xhscover.cn. If you include any sensitive information in the prompt, it will be transmitted. - The CLI will store your API Key locally (README notes ~/.xhscover). The skill metadata did not declare this config path or a required credential—treat that omission as a transparency gap. - Actions you can take: verify the npm package (npmjs page), review the GitHub repository code and issues, check publisher reputation, and consider creating a dedicated/minimal API key for this service. If you are uncomfortable, do not enable autonomous invocation or avoid installing the skill; instead run the CLI manually in a controlled environment to test it first. Confidence note: I judged this as 'suspicious' because the behavior is consistent with the skill's purpose but the metadata omissions (no declared API key or config path) and runtime execution of remote npm code warrant extra caution. Additional evidence that would change the verdict: an authoritative homepage and verified GitHub repo matching the npm package, explicit metadata listing the config path or credential, or a reproducible audit of the npm package contents showing no unexpected actions.

Type: OpenClaw Skill Name: xhs-cover Version: 3.0.0 The skill utilizes a shell script (`xhs-cover.sh`) to execute an external NPM package via `npx`, which introduces supply chain risks by downloading and running remote code. It also handles API keys stored in the user's home directory (`~/.xhscover`) and transmits data to an external service (`api.xhscover.cn`). While these behaviors are documented and aligned with the stated purpose of generating images, the use of shell execution, credential management, and external network calls constitutes a high-risk attack surface as defined in the analysis criteria.