XHS Writing Coach

v0.2.0

Coach and generate Xiaohongshu (小红书/RedNote/XHS) note writing. Use when the user wants help writing XHS notes (标题/正文/标签/评论引导/封面文案), improving engagement, or...

1· 865·6 current·6 all-time
byHerveClawd@herve-clawd
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description, templates, and required artifacts are consistent with a social-media note writing coach. No binaries, env vars, or external credentials are requested that would be unexpected for a writing assistant.
!
Instruction Scope
The SKILL.md and strategy notes instruct the agent to update the skill's 'living' strategy file, keep a 7-day history and forbidden-phrase lists, and produce a reference link using a named tool ('Tavily'). They also include an explicit constraint 'no #AI生成内容' in the contract section (i.e., avoid adding AI disclosure). These items broaden scope beyond one-off text generation: they imply persistent state, possible content-policy evasion, and external web lookups without explaining how or whether credentials/consent are needed.
Install Mechanism
Instruction-only skill with no install spec and no code files. Nothing is written to disk by an installer; risk from the install mechanism is low.
Credentials
The skill requests no environment variables or credentials, which is proportionate. However, it references external tooling ('Tavily') and asks for keeping links/citations and a rolling history; the skill gives no detail on how external searches or persistent storage will be performed, which could lead to unexpected data flows.
!
Persistence & Privilege
The strategy notes explicitly call the strategy file a 'long-term “know-how” memory' and instruct 'Update it whenever we learn new tactics or notice repetition' and to keep a 7-day history and forbidden-phrases list. Those are instructions for persistent state. While not inherently malicious, they create persistent storage of generation history and could retain user-provided content unless you confirm retention policy and access controls.
What to consider before installing
This skill appears to do what it says (generate XHS/RedNote posts) but has several red flags you should consider before installing: 1) Persistence: the skill asks to update and maintain strategy/knowledge files and a 7-day history — confirm whether the agent will actually write or retain user content and where that data is stored and who can read it. 2) Policy evasion: the 'no #AI生成内容' constraint suggests removing AI-disclosure tags; consider whether that conflicts with platform rules or your own compliance needs. 3) External lookups: the notes reference a third-party search tool (Tavily) and ask for reference links without declaring how searches are performed or whether credentials are needed. Ask the maintainer/owner how web searches and citations are fetched and whether any external endpoints or credentials are used. 4) If you plan to publish content created with this skill, explicitly decide whether you want the skill to add AI disclosure when required and turn off any behavior that attempts to remove mandated labels. If you want to proceed, request explicit documentation from the publisher about: where persistent files live, retention/erase policy for user inputs, what external services (if any) are called at runtime, and whether the skill will autonomously modify its own files or keep histories of generated posts.

Like a lobster shell, security has layers — review code before you run it.

latestvk97dpkz378g2x5nmtj16mqknzn82bk39

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Comments