ℹ
Purpose & Capability
The code and instructions match the stated purpose: fetching Baidu hot topics, generating Xiaohongshu copy, and calling a Seedream (火山引擎) image-generation endpoint. However, the SKILL.md does not declare the API key requirement as an environment variable or credential even though the script requires an API_KEY; instead it instructs the user to write the key into scripts/generate.py. That mismatch and the recommendation to embed a secret in source is disproportionate and unusual.
!
Instruction Scope
SKILL.md directs the agent/user to ask for the ByteDance/Seedream API key and store it inside generate.py. That expands scope to collecting and persisting a sensitive secret into code. The script performs network requests (to Baidu and the Volcengine endpoint) and writes files into /root/.openclaw/workspace by default; these actions are coherent with the feature but the instructions enable secret persistence in code and assume write access to /root, which is risky and not least-privilege.
✓
Install Mechanism
No install spec (instruction-only + included script). Nothing is downloaded at install time and no external archive or unknown URLs are used by the installer. Execution requires Python and the requests library (not declared), which is a modest expectation.
!
Credentials
The skill requires a Seedream/ByteDance API key to function, but this is not declared in requires.env or primary credential fields; instead the SKILL.md instructs the user to paste the API key into the script. Asking to store a secret in source is disproportionate and dangerous. The script otherwise requests network access to Baidu and the Volcengine API only (no unrelated cloud creds), so the scope of credentials is small but handled insecurely.
✓
Persistence & Privilege
always:false and user-invocable:true (defaults) — no elevated persistent privilege requested. The skill writes output files to a workspace directory (default /root/.openclaw/workspace) and stores generated artifacts, which is expected behavior for a content generation tool and does not modify other skills or system-wide settings.
Scan Findings in Context
[unicode-control-chars] unexpected: The SKILL.md contained unicode control characters flagged by the scanner. This is not necessary for the skill's stated purpose and can be used for prompt-injection or to obfuscate instructions; the presence is suspicious and should be removed or explained by the author.
What to consider before installing
This skill appears to implement the advertised workflow, but it asks you to paste your Seedream/ByteDance API key directly into scripts/generate.py — do NOT store secrets in source. Before installing or running: (1) inspect and, if needed, modify generate.py so it reads the API key from an environment variable or a protected config file instead of embedding it; (2) verify the Seedream API endpoint (ark.cn-beijing.volces.com) is the legitimate service you expect; (3) run the script in an isolated environment (container or VM) because it writes files under /root/.openclaw/workspace and makes outbound HTTP requests; (4) remove or ask the author to explain the unicode control characters in SKILL.md; (5) ensure Python and the requests package are present and consider reviewing/downloaded image URLs before following them. If you cannot confirm the endpoint or the control-characters explanation, treat this skill as risky and avoid providing high-privilege or reusable secrets.
