Hot Content Writer

What to consider before installing: - Inspect the bundled Python files (generate.py, daily_content.py) yourself. They are included and executable; the behavior described below is visible in the code. - API keys: the skill will accept a DeepSeek key (recommended) but also reads OPENAI_API_KEY and other environment fallbacks. Only provide a dedicated, limited‑scope API key. Do not reuse high‑privilege keys. - Cross‑skill execution: daily_content.py will try to run sibling 'hot' scripts (e.g., bilibili-hot-daily/fetch_hot.py, weibo-hot-daily/fetch_hot.py) from the workspace using subprocess.run. If you install this into a workspace containing other scripts, those scripts could be executed. Run this in an isolated workspace or verify/clean the workspace first. - File paths: the daily script writes to a hardcoded Windows path (C:\tmp\hot_*.json). On non‑Windows systems behavior may be unexpected; check and, if needed, modify paths to a safe location. - Network calls: the generator will send prompts to an external API (api.deepseek.com or whatever api_base you configure). Expect data (topics/prompts) to be transmitted to that provider; if prompts contain sensitive information do not send them. - Prompt‑injection indicator: the SKILL.md had unicode control characters flagged — this could be a benign formatting artifact but could also indicate attempts to manipulate LLM prompts. Review SKILL.md and prompt construction in generate.py (build_prompt) and sanitize any inputs that will be forwarded to the API. Recommended actions: - Use a sandbox or isolated environment to run the skill first. - Provide a purpose‑limited API key and monitor usage/billing from the provider dashboard. - Audit or remove any unexpected sibling scripts in the workspace before using the '--from-hot' or daily automation features. - If you need the skill to run automatically, consider implementing stricter path handling and limits, and avoid placing it in a workspace with untrusted scripts. If you want, I can point out the exact lines that read environment variables, call subprocesses, or write to C:\tmp so you can review/patch them before running.