hit-content-writer

PassAudited by ClawScan on May 10, 2026.

Overview

This is a coherent content rewriting and reference-storage skill, but users should be aware it depends on external tools, an embedding API key, and persistent vector storage.

Before installing, verify the `jl-vector-store` package and any referenced helper skills, configure the embedding API key carefully, and only store or analyze content you are comfortable persisting and potentially sending to the configured embedding provider.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Installing the helper tool gives third-party code local execution capability; if the package is compromised or changes behavior, it could affect the user's environment.

Why it was flagged

The skill relies on an external CLI package for vector storage, but the provided artifacts do not pin a version or include the package source for review.

Skill content
uv tool install jl-vector-store
Recommendation

Install only from a trusted source, consider pinning a known-good version, and review the helper tool before using it with important or private content.

What this means

The skill may use the configured embedding API key, which can consume quota or access the configured embedding service.

Why it was flagged

The docs request an embedding API credential. This is expected for vectorization, but it is not declared in the registry requirements.

Skill content
export EMBEDDING_API_KEY="your-api-token"
Recommendation

Use a scoped API key if available, keep it out of shared files and logs, and the skill publisher should declare this credential requirement in metadata.

What this means

Content stored or queried through embeddings may be processed by an external provider, so private or confidential text could leave the local environment.

Why it was flagged

The README configures an external embedding provider for vectorization. User-provided content may need to be sent to that provider to create embeddings.

Skill content
export EMBEDDING_BASE_URL="https://api.siliconflow.cn/v1/embeddings"
Recommendation

Do not store sensitive personal or confidential content unless you trust the embedding provider and its data policy; consider a local embedding endpoint for private material.

What this means

Stored examples can influence later searches and rewrites, and accidentally stored private or low-quality content may be reused later.

Why it was flagged

The skill intentionally persists reference content for future semantic search and reuse. This is central to its purpose, but retention and deletion controls are not described.

Skill content
向量化存储: 使用ChromaDB存储爆款内容的向量表示
Recommendation

Store only intended reference content, avoid personal data, and add or document clear deletion, retention, and review controls for the vector database.