小红书爆款笔记生成器

AdvisoryAudited by Static analysis on May 6, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI03: Identity and Privilege Abuse

What this means

Installing or using the skill may consume the user’s DeepSeek account quota or billing through their configured API key.

Why it was flagged

The skill uses a DeepSeek API key from the environment or local OpenClaw configuration and sends it as a bearer token to DeepSeek.

Skill content

let API_KEY = process.env.DEEPSEEK_API_KEY || ''; ... '.openclaw/openclaw.json' ... config.models?.providers?.deepseek?.apiKey ... 'Authorization': `Bearer ${API_KEY}`

Recommendation

Use only with a DeepSeek key you intend to make available to OpenClaw, monitor usage, and prefer a scoped or dedicated API key if possible.

Note

ASI07: Insecure Inter-Agent Communication

What this means

Any product, topic, or details included in the request are transmitted to DeepSeek for processing.

Why it was flagged

The user’s requested topic is placed into a prompt and sent to DeepSeek’s external chat-completions API.

Skill content

hostname: 'api.deepseek.com', path: '/v1/chat/completions' ... { role: 'user', content: prompt }

Recommendation

Avoid including private, confidential, or regulated information in prompts unless you are comfortable sending it to DeepSeek under its terms.