Security audit
Security checks for vulnerabilities and agentic risk
This skill is a local Xiaohongshu content generator with disclosed, purpose-aligned behavior and no evidence of hidden access, persistence, or exfiltration.
Installers should treat this as a Chinese-market copywriting helper. Review generated claims before posting, especially for skincare, supplements, or medical-adjacent products, and use --output only with a path you are comfortable creating or overwriting.
The skill advertises itself as self-contained but documents an --output option that saves generated content to a file, while the manifest declares no explicit tool scope or permission boundary. In an agent environment, undocumented write capability can lead to unintended file creation or overwrite if the host maps this skill to file-system tools without user-visible constraints.
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
author: ClawHub Community
category: Content Creation
description: Generate 3 viral-ready Xiaohongshu (Little Red Book) notes from a product, scene, or topic — titles, body copy, hashtags, cover-image tips, and publish-time recommendations.
model: agent
tags:
- xiaohongshu
- little-red-book
The file states the skill generates body copy as '150–300 Chinese characters,' which imposes a specific language requirement in the skill behavior. While the skill targets Xiaohongshu, the documentation does not explicitly present Chinese output as a user-selectable option or clearly frame the locale restriction as a documented regional limitation for all uses.
Line L11 instructs users to use '5-8 Chinese characters max' as a blanket rule. This is a natural-language locale constraint that forces a specific language without user opt-in or any documented justification that the skill is limited to a Chinese-language context.
The title and description define the skill specifically for generating Xiaohongshu notes, and the examples and style enums throughout the schema are entirely Chinese-language oriented. Because the file does not state that this is a region-specific or platform-specific language constraint, it appears to enforce a locale without explicit user opt-in.
This JSON schema contains natural-language constraints requiring Chinese output, such as 'recommended under 20 Chinese characters' and '150-300 Chinese characters,' along with Chinese-only examples. That creates a locale/language policy issue because the skill appears to mandate a specific language rather than offering a user choice or documenting a justified region-specific constraint.
The script's natural-language templates, examples, and generated content are all fixed to Chinese and the Xiaohongshu platform context. This enforces a specific language/locale behavior without presenting an opt-in or alternative language choice, which matches the language/locale policy violation criteria.
The manifest describes a skill that generates Xiaohongshu notes with titles, body copy, hashtags, cover-image tips, and publish-time recommendations. The code additionally supports writing output to any user-specified file path, which is a side effect not reflected in the manifest description and is not necessary to the core generation function itself.
This markdown file is almost entirely Chinese-language content, including headings and hashtag guidance, and does not indicate that the user can choose another language or that the file is intentionally limited to a Chinese-speaking audience. Under the language/locale policy rule, forcing a specific language without opt-in can be a natural-language policy violation.
This reference file presents writing templates partly in Chinese and partly in English, and the punctuation and emoji guidance is framed as a general template set rather than explicitly limited to a Chinese-language or Xiaohongshu-only audience. Because the file does not offer a language choice or clearly justify the locale constraint, it may conflict with a policy requiring user opt-in for language or locale preferences.
This code writes generated content to a user-specified path, which is a file-modifying operation. Although it prints a success message after writing, there is no confirmation prompt or explicit warning near the argument definition or write path that using --output will create or overwrite a local file.
The file repeatedly specifies Chinese-platform content generation, including the name, description, tags, and keywords centered on Xiaohongshu and Chinese marketing. Under the policy, forcing a specific language or locale without user opt-in can be a natural-language policy violation, and this manifest does not indicate any language choice or opt-in.
No suspicious patterns detected.