v1.0.0

小红书卡片生成器

BenignClawScan verdict for this skill. Analyzed May 1, 2026, 6:34 AM.

Analysis

This skill appears to be a straightforward local image-card renderer, with only minor notes about local file handling and undeclared setup/provenance details.

GuidanceThis looks safe for normal use as a local card generator. Before installing or invoking it, make sure Python/Pillow are available from trusted sources, use only the Markdown/text files you intend to render, and choose a dedicated output folder because the scripts create or overwrite PNG files there.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Tool Misuse and Exploitation

SeverityLowConfidenceHighStatusNote

SKILL.md

python3 {baseDir}/scripts/<script_name>.py "标题" "副标题" "文案路径" "输出目录"

The skill uses a local command with user-provided title, subtitle, input path, and output directory. This is expected for rendering cards, but arguments should be treated as data and paths should be user-approved.

User impactIf the agent chooses the wrong input or output path, it could render unintended local text or overwrite generated image filenames in that folder.

RecommendationUse only intended .md/.txt files and a dedicated output directory; ensure shell arguments are safely quoted or passed without raw string interpolation.

Agentic Supply Chain Vulnerabilities

SeverityInfoConfidenceHighStatusNote

metadata

Source: unknown; Homepage: none

The package provenance is not identified, so users have less external context for the author or maintenance source even though the included code itself appears coherent and purpose-aligned.

User impactUsers cannot easily verify the upstream project or maintainer outside the provided artifacts.

RecommendationReview the included scripts before use and install required dependencies such as Pillow from trusted sources.