便签导出

通过 notes.fangyuanxiaozhan.com 提供的托管 API，把 Markdown 内容导出为锤子便签风格的长图 PNG。用户提到“便签导出”“锤子便签”、Markdown 转图片、把本地 .md 文件渲染成便签长图、或需要用脚本批量导出便签图片时使用。

Security Scan

The skill does what it says — it sends Markdown to a hosted API and writes back a PNG — but it posts your content to an external endpoint and the package metadata omits required runtime binaries, so review privacy and runtime environment before using.

Purpose & Capability

The skill's declared purpose (remote Markdown→image export via notes.fangyuanxiaozhan.com) matches the implementation: the included script posts JSON to that API and saves a PNG. However, the registry metadata declares no required binaries, while the script relies on common tools (curl and python3). This is an inconsistency in the metadata (likely an omission) but not itself a sign of malicious intent.

Instruction Scope

The SKILL.md and scripts stay on-task: they read a single local Markdown file or inline Markdown, package it into JSON, POST it to the stated API, and save the response as a PNG. Important caveats: the script transmits the full Markdown to an external host (as intended by the skill) and does not explicitly check HTTP status codes before writing output (curl will write the response body even on non-200 responses). There is no code that reads unrelated files or environment variables.

Install Mechanism

There is no install spec and no downloads; the skill is instruction/script-only. This minimizes install-time risk. The only install-like requirement is that the runtime must provide standard tools (curl, python3); those are not installed by the skill.

Credentials

The skill requests no credentials or environment variables, which is appropriate. The proportionality concern is that user content (the full Markdown) is sent to an external service — expected for a hosted-export service but potentially sensitive. There are no unrelated credentials requested.

Persistence & Privilege

The skill does not request persistent privileges, does not set always: true, and does not modify other skills or system configuration. It is user-invocable and can be invoked autonomously by the agent (the platform default).

Assessment

This skill is coherent with its description: it posts your Markdown to a hosted API (notes.fangyuanxiaozhan.com) and writes the returned PNG to disk. Before installing or using it: 1) Treat any Markdown you send as potentially exposed — do not send sensitive secrets or private data to the remote service. 2) Ensure your runtime has curl and python3 available (the registry metadata doesn't list these). 3) Test with innocuous content first to confirm behavior and error handling (the script does not explicitly verify HTTP status codes before writing output). 4) If you need stronger privacy, consider running a local renderer or hosting a trusted instance of the API. If you want higher assurance about the remote service, verify the operator or source of notes.fangyuanxiaozhan.com before sending confidential notes.

便签导出 API

直接调用托管 API 做便签导出，不在本地重写渲染逻辑。

工作流

1. 使用 scripts/export_note.sh。
2. 传入 --markdown-file 或 --markdown。
3. 传入 --output。

脚本用法

skills/notes-export-api/scripts/export_note.sh \
  --markdown-file /abs/path/to/note.md \
  --output /abs/path/to/note.png

skills/notes-export-api/scripts/export_note.sh \
  --markdown '## **0x01**\n正文内容' \
  --output /abs/path/to/note.png

注意事项

• 本地 Markdown 文件按 UTF-8 读取。
• 遇到非 200 响应时，直接把错误返回给调用方。