XiaoHongShu Viral Post Generator
v1.0.2AI 一键生成小红书爆款笔记（标题、正文、标签、封面提示、发帖策略）。真实种草风，防封号友好。
⭐ 0· 371·1 current·1 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description, required env vars (OPENAI_API_KEY, SKILLPAY_KEY), and code (openai + axios usage, datamuse keyword fetch, SkillPay charge) all align with generating social media posts and per-call billing. Declared dependencies in package.json match functionality.
Instruction Scope
SKILL.md and code instruct the agent to call OpenAI, a public keyword API, and SkillPay. The runtime only reads the declared env vars and the input.topic; it does not scan local files or read unrelated system data. External network calls are limited to expected endpoints.
Install Mechanism
There is no explicit install spec (instruction-only) which minimizes install-time risk, but a package.json is present listing npm deps (openai, axios). If installed, npm will fetch these packages — standard but worth auditing if you install locally.
Credentials
Requested env vars (OPENAI_API_KEY for content generation, SKILLPAY_KEY for billing) are proportional to the stated purpose. Minor inconsistency: the code reads an optional SKILLPAY_ENDPOINT env var (to override billing endpoint) but SKILL.md does not declare it; it's optional and not required. Both declared keys are sensitive and would be sent to their respective services (OpenAI, SkillPay).
Persistence & Privilege
The skill is not force-included (always: false), does not request elevated system privileges, and does not modify other skills or system-wide configs. Autonomous invocation is allowed by default but not combined with other red flags.
Assessment
This skill appears to do what it says: it sends your topic to OpenAI to generate title/content and to SkillPay to charge per call. Before installing: (1) ensure you trust the SkillPay provider and the billing ID (you will need to provide SKILLPAY_KEY); (2) understand that any input/topic will be transmitted to OpenAI and the public keyword API; (3) if you install locally, npm will fetch dependencies (openai, axios) — consider auditing them or running in a restricted environment; (4) test with non-sensitive topics and confirm billing behavior and endpoints (note: SKILLPAY_ENDPOINT can be overridden via env but isn’t declared in docs). If any of these are unacceptable, do not install or provide the keys.Like a lobster shell, security has layers — review code before you run it.
aivk977frphj01h8sxeazqbd5v69x82b2jdcontentvk977frphj01h8sxeazqbd5v69x82b2jdlatestvk97dxk1d59rfcr1h41gf3r2s6582ac0vmarketingvk977frphj01h8sxeazqbd5v69x82b2jdsocial-mediavk977frphj01h8sxeazqbd5v69x82b2jdxiaohongshuvk977frphj01h8sxeazqbd5v69x82b2jd
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🌸 Clawdis
EnvOPENAI_API_KEY, SKILLPAY_KEY
Primary envOPENAI_API_KEY