小红书图文生成器

小红书图文生成技能 - 基于热点话题自动生成小红书风格的图文内容（文案 +HTML+ 图片）

This skill appears to do what its description says (generate Xiaohongshu-style HTML and images), but take precautions before installing or running it: - Inspect and remove or modify temp-convert.js before running. It contains hardcoded absolute Windows paths to a user's .openclaw workspace; running it as-is will read/write those locations and launch Puppeteer. - Expect npm install (or equivalent) to fetch Puppeteer and a Chromium binary (large download). If you do not want Chromium downloaded or executed, avoid installing or run in an isolated environment. - The skill requests filesystem, shell, and browser tool usage — necessary for rendering HTML to images but capable of broad actions. Only enable these tool permissions if you trust the code and run it with least privilege (non-admin account, sandboxed environment). - Verify the referenced peer skill html-pages-to-images (file:../html-pages-to-images). If that dependency is not present or is replaced, behavior may change. - If you plan to use the skill to fetch hot-trend data, prefer providing the hotData from trusted sources or from separate vetted skills; the SKILL.md suggests scraping public platforms but the package does not include scrapers for those platforms. - Consider running the skill in a disposable VM/container or reviewing the code and removing any hardcoded paths, then running tests on non-sensitive directories first. If you want, I can point out exact lines in temp-convert.js to change, suggest safer defaults for paths, or produce a sanitized version of the script that accepts paths via parameters instead of hardcoding them.

Type: OpenClaw Skill Name: xiaohongshu-article-generator Version: 1.0.0 The skill bundle is classified as suspicious due to a lack of input sanitization on the 'topic' parameter in index.js, which is used directly in filesystem operations (mkdirSync, join), creating a path traversal vulnerability. Furthermore, temp-convert.js and EXAMPLES.md contain hardcoded absolute file paths specific to a Windows administrator environment (C:/Users/Administrator/...), which is atypical for portable skills and poses a risk if executed in environments with similar structures. While the core logic aligns with the stated purpose of generating social media content, these vulnerabilities and the request for broad 'shell' and 'filesystem' permissions without robust safety checks warrant caution.