Weekly Menu 每周菜单

Generate a weekly meal plan with images, recipes, and shopping lists. Searches Xiaohongshu (小红书) for trending seasonal recipes, creates a beautifully formatt...

Security Scan

The skill's behavior (creating Feishu docs and searching Xiaohongshu) generally matches its description, but the runtime instructions read and use platform configuration and memory files containing Feishu credentials/tokens without declaring those config/credential requirements — this mismatch is concerning.

Purpose & Capability

The declared purpose (generate weekly menus from Xiaohongshu and store them in Feishu) aligns with the instructions: searching Xiaohongshu via agent-reach, composing content, downloading images, and creating Feishu docs. However, the SKILL.md expects access to Feishu app credentials and a receipts folder token (platform config and MEMORY.md) while the skill metadata declares no required env/config paths or credentials — that is an inconsistency.

Instruction Scope

The instructions explicitly tell the agent to read platform files: ~/.openclaw/openclaw.json (channels.feishu.accounts.default) for app_id/app_secret and MEMORY.md for the receipts folder token. They also read and write local profile/history files (meals/profile.yaml, meals/history.yaml) and store downloaded images in workspace/tmp/dishes/. Reading hidden platform config and memory files is outside the skill's obvious scope and can expose other channels' secrets or tokens.

Install Mechanism

Instruction-only skill with no install spec or third-party downloads. No code is written to disk by an installer, which reduces risk from supply-chain installs.

Credentials

The skill metadata declares no required environment variables or credentials, but the workflow requires Feishu app_id/app_secret and a receipts folder token (from platform config/MEMORY.md) and uses agent-reach Xiaohongshu channel. Access to those credentials is proportionate to creating documents in Feishu, but the absence of declared required config/credential fields is inconsistent and could lead to unintentional exposure of platform secrets.

Persistence & Privilege

always is false and the skill is user-invocable; it does not request permanent/always-on presence. It will create and modify documents in the user's Feishu drive (expected for its function) but does not request modifications to other skills or system-wide settings.

Scan Findings in Context

[scanner.no_findings] expected: No regex scan findings — expected because this is an instruction-only skill with no executable code. Absence of findings does not imply safety; main surface is SKILL.md instructions.

What to consider before installing

This skill will search Xiaohongshu (via the agent-reach channel), download images, and create Feishu documents. Before installing: 1) Confirm you want the skill to read/write meals/profile.yaml and meals/history.yaml in the agent workspace. 2) Understand that it expects to read Feishu credentials and folder tokens from platform files (~/.openclaw/openclaw.json and MEMORY.md) — verify what these files contain and whether you are comfortable a skill will access them. 3) Ensure the Feishu channel/account used is limited (create a dedicated app/service account with only the required doc/drive scopes) so a compromised skill can't access unrelated resources. 4) If you prefer stricter disclosure, ask the author to declare required config paths/credentials in the skill metadata (app_id/app_secret and receipts folder token) or modify the workflow to accept explicit, scoped credentials from the user at runtime. If you cannot verify or restrict the Feishu credentials and MEMORY.md contents, treat this skill as higher-risk and avoid installing it.

Weekly Menu Skill

Generate a weekly meal recommendation document with images and Xiaohongshu source links, stored as a Feishu doc in the receipts folder.

Prerequisites

• agent-reach skill installed (Xiaohongshu channel configured)
• Feishu channel configured with permissions: docx:document, docx:document:create, drive:drive
• User profile at meals/profile.yaml (see references/profile-template.yaml)

Workflow

1. Load User Profile

Read meals/profile.yaml for:

• location — determines seasonal ingredients
• household.portions — serving size
• cooking.equipment — available appliances (air fryer, pressure cooker, etc.)
• cooking.timeAvailable — quick/moderate/slow
• cooking.spiceTolerance — none/mild/medium-hot/hot
• preferences.cuisinesFavourite — preferred cuisines
• preferences.explorationLevel — conservative/adventurous
• schedule.cookingDays — how many days per week

If profile doesn't exist, ask user the basics and create one from references/profile-template.yaml.

2. Search for Recipe Inspiration

Use agent-reach Xiaohongshu search to find trending recipes:

mcporter call 'xiaohongshu.search_feeds(keyword: "<search_term>")'

Search strategy (3-5 searches):

• Current season + location + "时令菜"
• Equipment-specific: "空气炸锅 家常菜", "高压锅 菜谱"
• Cuisine preference: "川菜 家常", "苏菜 做法"
• General: "一周菜谱 简单好吃"

Pick the top results by likes/collects. Aim for 20 candidate dishes across 6 categories:

• 🌿 春季时令 (seasonal)
• 🔥 空气炸锅 (air fryer)
• 🍲 高压锅硬菜 (pressure cooker)
• 🌶️ 下饭菜 (rice killers)
• 🏠 经典家常 (classic home cooking)
• 🍳 快手 & 主食 (quick meals & staples)

3. Compose the Menu

Organize 20 dishes into 6 themed sections based on equipment, cuisine, and cooking method:

• Balance variety: don't repeat proteins or methods within a section
• Each dish needs: number (①-⑳), name, one-line description, cooking time, equipment used

4. Download Dish Images

Download a representative image for each dish (from Unsplash or similar free sources — Xiaohongshu CDN blocks direct downloads):

curl -sL --connect-timeout 10 --max-time 20 -o ./tmp/dishes/01-name.jpg "<url>"

Store in workspace/tmp/dishes/. Verify each file is a valid JPEG/PNG (not empty or HTML error).

5. Create Feishu Document

Read references/feishu-doc-recipe.md for the full Feishu API procedure.

Summary:

1. Create doc with title 🍽️ YYYY-MM-DD 推荐菜单 (Monday's date) in receipts folder
2. Grant user full_access permission
3. Insert blocks in ≤50-block batches. For each dish, create these blocks in order:
   • heading3 (block_type 5) — dish name, enables table of contents navigation
   • todo/checkbox (block_type 17, done: false) — same dish name, for user to check off
   • text (block_type 2) — description + cooking time
   • empty image (block_type 27) — placeholder, filled later
   • text with link — "📌 小红书菜谱" linking to XHS post
4. After all text blocks inserted, fill images: upload to drive → patch with replace_image
5. Sections separated by divider (block_type 22) + heading2 (block_type 4)

Key constraints:

• Max 50 blocks per insert call — split 20 dishes into 4 batches (~25 blocks each)
• Max 3 edits/second per document — use time.sleep(0.4) between API calls
• Image blocks must be created empty ({"block_type": 27, "image": {}}) then filled via patch
• Insert batches bottom-to-top when adding blocks to avoid index shifting

6. Share Result

Send the document link to the user in chat. Format:

🍽️ 本周菜单已出炉！20 道菜已备好

👉 <document_url>

打开文档，从目录浏览所有菜，勾选你想做的～

7. Update History

Append the week's menu to meals/history.yaml for future reference and to avoid repeats.

Config

Key	Location	Description
User profile	meals/profile.yaml	Taste preferences and constraints
Receipts folder	Feishu drive	Token stored in MEMORY.md
Meal history	meals/history.yaml	Past menus to avoid repeats

File References

• references/profile-template.yaml — blank user profile template
• references/feishu-doc-recipe.md — step-by-step Feishu document creation API guide