小红书爆款笔记生成器

PassAudited by ClawScan on May 6, 2026.

Overview

The skill does what it claims—generate Xiaohongshu-style posts—but it uses a DeepSeek API key and sends the user’s topic to DeepSeek.

This looks like a straightforward AI writing helper. Before using it, make sure you are comfortable letting it use your DeepSeek API key and sending the prompt topic/details to DeepSeek. Do not include sensitive personal, client, or business-confidential information unless that external processing is acceptable.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI03: Identity and Privilege Abuse

What this means

Installing or using the skill may consume the user’s DeepSeek account quota or billing through their configured API key.

Why it was flagged

The skill uses a DeepSeek API key from the environment or local OpenClaw configuration and sends it as a bearer token to DeepSeek.

Skill content

let API_KEY = process.env.DEEPSEEK_API_KEY || ''; ... '.openclaw/openclaw.json' ... config.models?.providers?.deepseek?.apiKey ... 'Authorization': `Bearer ${API_KEY}`

Recommendation

Use only with a DeepSeek key you intend to make available to OpenClaw, monitor usage, and prefer a scoped or dedicated API key if possible.

Note

ASI07: Insecure Inter-Agent Communication

What this means

Any product, topic, or details included in the request are transmitted to DeepSeek for processing.

Why it was flagged

The user’s requested topic is placed into a prompt and sent to DeepSeek’s external chat-completions API.

Skill content

hostname: 'api.deepseek.com', path: '/v1/chat/completions' ... { role: 'user', content: prompt }

Recommendation

Avoid including private, confidential, or regulated information in prompts unless you are comfortable sending it to DeepSeek under its terms.