Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

视频号爆款 IP 脚本工厂

v1.3.0

生成适合视频号发布的爆款IP内容方案:选题、标题、钩子、口播脚本、镜头建议、封面文案、发布文案、评论引导,以及医美场景下的基础合规改写。

0· 150·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for yangfu20171212-hue/video-wechat-ip-script-agent.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "视频号爆款 IP 脚本工厂" (yangfu20171212-hue/video-wechat-ip-script-agent) from ClawHub.
Skill page: https://clawhub.ai/yangfu20171212-hue/video-wechat-ip-script-agent
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required binaries: node
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install video-wechat-ip-script-agent

ClawHub CLI

Package manager switcher

npx clawhub@latest install video-wechat-ip-script-agent
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
Name/description (video‑script generation for 视频号 / medical-aesthetics) match the package contents: prompt templates, config, services for topics/script/rewrite/compliance, and a local Node CLI. The only runtime external dependency is an LLM API (MODEL_API_KEY / OPENAI_API_KEY) which is expected for a generation skill.
Instruction Scope
SKILL.md and the code limit operations to building prompts, reading bundled config/prompts, invoking a model endpoint, and returning structured JSON. The code reads only local project config/prompt files and stdin/CLI-provided JSON; it does not scan arbitrary system files, read other credentials, or send data to unexpected third-party endpoints beyond the configured model base URL.
Install Mechanism
No install spec that downloads external archives; the bundle is instruction‑first with included source and dist files and expects Node to run locally. Dependencies are dev-only (TypeScript types/build). No high-risk remote downloads or unusual install locations.
Credentials
The registry metadata lists no required env vars, but runtime supports/needs MODEL_API_KEY or OPENAI_API_KEY (and MODEL_BASE_URL / OPENAI_BASE_URL / MODEL_MOCK_RESPONSE) to call an external model. This is proportional to the skill's purpose but users should be aware providing an API key allows the skill to make external requests to that model gateway.
Persistence & Privilege
The skill does not request always: true and does not modify other skills or system settings. It runs on demand or via the agent runtime; autonomous invocation is the platform default but not elevated here.
Scan Findings in Context
[system-prompt-override] expected: The bundle intentionally includes system/persona prompts (prompts/system-prompt.md, persona.md, and others) and the promptBuilder injects those into the built prompt. The scanner flagged a 'system prompt override' pattern in SKILL.md, but that is expected because the skill constructs its own system-level instructions for the model. Review the prompt files to ensure they don't contain undesired directives.
Assessment
This skill appears to be what it says: a local Node-based generator for 视频号 scripts, rewrites, topics and medical-aesthetics compliance checks. Before installing: - Review prompts/ and config/ files (system-prompt.md, persona.md, config/*.json) to ensure they don't contain hidden instructions you don't want sent to an LLM. - If you provide a MODEL_API_KEY / OPENAI_API_KEY, the skill will send prompts (including JSONified local config) to the configured model base URL; prefer using a gateway with limited quota/monitoring if you are concerned. - For offline testing, use MODEL_MOCK_RESPONSE to avoid network calls. - The skill reads only files bundled with the skill and inputs you provide; it does not exfiltrate to unexpected endpoints beyond the model API. If you need stronger guarantees, inspect dist/ or run in an isolated environment first.
tests/openclaw.mock.test.js:299
Shell command execution detected (child_process).
dist/lib/modelInvoker.js:8
Environment variable access combined with network send.
lib/modelInvoker.ts:29
Environment variable access combined with network send.
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

🎬 Clawdis
Binsnode
latestvk97az35xt156ecq8y3fb9a2yvd83arzx
150downloads
0stars
1versions
Updated 1mo ago
v1.3.0
MIT-0

视频号爆款 IP 脚本工厂(增强版)

这是一个可直接放入 OpenClaw 的技能目录,面向中文视频号内容生产,尤其适合:

  • 医美机构经营
  • 医美项目表达
  • AI × 医美
  • 老板观点输出
  • 个人 IP 内容策划

本技能不是“随便写一段文案”,而是尽量输出可直接拍摄、可直接发布的一整套视频号内容。

包内文件

  • AGENTS.md:项目级行为规则
  • openclaw.ts:可执行 skill 入口,接收 JSON 请求
  • index.ts:统一导出服务能力与 runOpenClawSkill
  • prompts/:系统提示词、人物设定、脚本生成、风格改写、合规检查
  • config/:行业/风格/平台默认配置
  • schemas/:结构化输出字段定义
  • examples/:示例输入输出
  • checklist.md:人工验收清单

什么时候使用

当用户想要:

  • 生成视频号选题
  • 把一个主题扩写成视频号脚本
  • 把脚本改成不同风格
  • 检查医美相关文案的风险表达
  • 输出“标题 + 钩子 + 脚本 + 封面 + 发布文案 + 评论引导”完整发布包

默认工作模式

1)选题生成模式

输出 10~20 个选题,每个选题附带:

  • 类型(痛点型 / 反差型 / 观点型 / 方法型 / 案例型)
  • 推荐切入角度
  • 目标人群

2)脚本生成模式

默认输出完整发布包:

  1. 视频定位
  2. 爆款标题(5个)
  3. 前3秒钩子
  4. 口播脚本
  5. 镜头建议
  6. 封面文案
  7. 发布文案
  8. 评论区引导

3)风格改写模式

支持:

  • 犀利观点型
  • 温柔陪伴型
  • 专业干货型
  • 老板表达型
  • 高转化成交型

4)合规审查模式

优先用于医美内容,输出:

  1. 风险点
  2. 风险原因
  3. 修改建议
  4. 安全版本

默认规则

  • 前 3 秒必须抓人
  • 一次只讲 1 个核心观点
  • 语言必须口语化、短句化、可直接口播
  • 优先像真人表达,不像模板机器
  • 医美相关内容避免绝对化与效果承诺

安装方式

把整个文件夹放到以下任一目录:

  • ~/.openclaw/skills/
  • <workspace>/skills/

可调用入口

如果你希望把这个 skill 当成一个真实的本地执行入口来接入,而不只是 SKILL.md 指令,可以在构建后直接调用:

npm run build
echo '{"action":"script","payload":{"topic":"顾客不是嫌贵,是你不会讲价值"}}' | node dist/openclaw.js

输入必须是 JSON,结构如下:

{
  "action": "script",
  "payload": {
    "topic": "顾客不是嫌贵,是你不会讲价值"
  }
}

运行前置

  • 推荐先执行 npm run check
  • 如果要走真实模型调用,请设置 MODEL_API_KEYOPENAI_API_KEY
  • 如果只想验证入口链路,可设置 MODEL_MOCK_RESPONSE
  • 发布到 ClawHub 前,建议确保 dist/ 已经是最新构建产物

推荐测试指令

选题

“给我 10 个医美机构经营类的视频号选题,面向机构老板,偏观点型。”

脚本

“主题:顾客不是嫌贵,是你不会讲价值。帮我输出完整视频号发布包。”

改写

“把这段脚本改成更犀利、更像老板讲话的版本。”

合规

“帮我检查这段医美文案有没有风险,并给我一个更安全但还有吸引力的版本。”

Comments

Loading comments...