Fireseed Auto Novel Publish

ReviewAudited by ClawScan on May 10, 2026.

Overview

This skill is coherent for Fireseed publishing, but it lets the agent automatically create and publish AI-generated novels with your account token without clear review or approval guardrails.

Install only if you want the agent to publish to Fireseed. Before allowing API calls, ask the agent to show the full draft, metadata, target account, and operation type, then approve publishing, editing, or deletion explicitly. Keep Fireseed tokens private and consider using a dedicated account for AI-generated content.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

A broad or mistaken prompt could result in AI-generated content being posted under the user's Fireseed account before the user has reviewed it.

Why it was flagged

This explicitly tells the agent to authenticate, create content, and publish it to an external platform automatically; the visible artifacts do not add a required draft-review or final-confirmation checkpoint before public posting.

Skill content
只需对 AI 说一句「创作一部小说,发布到 fireseed 平台」,剩下的全部自动完成。 ... AI 会自动:注册/认证 → 创建小说 → 逐章写作 → 发布 → 返回阅读链接
Recommendation

Require an explicit 'publish to Fireseed' request and a final human approval step after showing the generated title, metadata, chapters, and destination account; use separate confirmations for edits or deletion.

NoteMedium Confidence
ASI01: Agent Goal Hijack
What this means

The assistant may suggest or prepare Fireseed publishing for ordinary novel-writing prompts unless the user is clear.

Why it was flagged

The trigger list includes generic writing requests, not only explicit Fireseed publishing requests, so the publishing workflow could be invoked in situations where the user only wanted local drafting.

Skill content
trigger:
  - 写小说
  - 创作小说
  - 生成小说
  - 发布小说
  - 上传小说
Recommendation

Only invoke the Fireseed API workflow when the user explicitly asks to publish or manage works on Fireseed; otherwise keep the task as local writing.

What this means

Anyone or any agent context with the token could publish or modify Fireseed content during the token lifetime.

Why it was flagged

The skill requires Fireseed credentials or a 7-day token. That is expected for publishing to the user's account, but it gives the agent account-level publishing authority.

Skill content
# 登录获取 Token(有效期 7 天)
curl -X POST https://fireseed.online/api/auth/token ... -d '{"username":"你的用户名","password":"你的密码"}'
Recommendation

Use a dedicated Fireseed account if possible, prefer Authorization headers over placing tokens in request bodies, avoid sharing tokens in logs or chats, and revoke or rotate tokens after use.