xhs-cover-generator

AI-powered cover design tool for Xiaohongshu creators that analyzes viral post data to generate high-conversion, platform-optimized cover designs.

Security Scan

The skill mostly does what its description claims, but it contains several unexpected and potentially unsafe choices — most notably a hardcoded third‑party API endpoint plus a custom HTTPS client that disables certificate verification and deliberately avoids SNI, and instructions that force the agent to fetch and embed unmodified remote images — these behaviors are disproportionate and warrant caution.

Purpose & Capability

The skill's stated purpose (generate Xiaohongshu cover designs from viral data) matches the included script and docs. However there are surprising elements: the Python script contacts a non-official domain (https://onetotenvip.com/skill/cozeSkill/getXhsCozeSkillData) rather than a known, documented API for Xiaohongshu, and the script implements a custom socket-based HTTPS client that purposely does not send SNI and disables TLS certificate verification. The SKILL.md declares a requests dependency but the provided script uses raw sockets/ssl instead of requests. These mismatches are unusual and not justified by the stated purpose.

Instruction Scope

Runtime instructions require running the included script and then: (a) directly using the original coverUrl fields (explicitly forbidding modification), (b) visiting and embedding the real cover images in reports, and (c) using the agent's image-reading tool to download/analyze each coverUrl. This forces the agent to make repeated outbound requests to remote hosts (which may be attacker-controlled), and to expose request metadata to the external API and image hosts. The docs also force strict terminology and insist on always including real images, which expands the scope of network I/O and increases data exposure.

Install Mechanism

No install spec is provided (instruction-only), which lowers installation risk. However the repo includes an executable script that will be run locally by the agent and which performs direct network connections using a custom TLS setup. There is no third-party package download, but executing the provided script still causes outbound network activity to the hardcoded endpoint.

Credentials

The skill does not request credentials, environment variables, or config paths (proportionate). Still, the code intentionally disables certificate checks and avoids SNI — techniques often used to evade network-level protections or to communicate with self-signed/hostile servers. The required behavior to fetch and embed cover images (unmodified) means the agent will contact external hosts and may leak usage patterns or data to those hosts; the skill does not document what data the API logs or retains.

Persistence & Privilege

The skill does not request persistent presence (always:false), does not modify other skills or system config, and has no install step that writes to system locations. There is no request for elevated privileges.

What to consider before installing

What to consider before installing/running this skill: - The included Python script contacts an unknown third‑party endpoint (onetotenvip.com) rather than an official Xiaohongshu API. Ask the author where that API comes from and whether it is trusted and permitted to serve this data. - The script disables TLS certificate verification (verify_mode = CERT_NONE) and intentionally avoids sending SNI. Those are red flags: they enable connections to servers with invalid/forged certs and can be used to evade detection. Do not run the script in a production environment or on sensitive systems until this is justified or fixed. - The instructions force the agent to fetch and embed the original coverUrl images unchanged and to analyze them with the agent's image tool. That causes many outbound requests to external hosts (potentially attacker-controlled) and can leak query terms or other metadata. If you must run it, do so from an isolated sandbox with monitored network egress. - The SKILL.md lists requests>=2.28.0 but the script does not use requests; this mismatch suggests the package was edited or assembled carelessly — request clarification from the maintainer and prefer a request-based implementation with proper TLS verification. - If you want similar functionality but safer behavior: require the API provider's provenance, use standard HTTPS clients that validate certs, or proxy all requests through a trusted service you control. Consider removing the requirement to embed unmodified remote images (download and cache after validating origin) and add logging of what is sent to external services. - If you cannot verify the endpoint or author: do not enable autonomous invocation; test the skill only in a restricted VM with network monitoring and no access to sensitive credentials or internal networks.

爆款封面生成

核心功能

专为小红书内容创作打造的AI封面设计工具，基于全网每日持续收录的2000+条爆款笔记数据，深度抓取同赛道爆款封面的视觉元素，通过AI智能分析总结高转化视觉规律，生成贴合笔记内容、符合平台流量审美的可落地封面设计方案，省去繁琐设计流程，提升笔记封面点击率。

触发本技能并需要执行完整流程时，必须先读取与本技能同目录下的 references/core_workflow.md，并完整遵循其中的触发规则、术语规范、数据来源约束、完整操作步骤、自检清单与注意事项。生成 HTML 报告时另需按该文档要求读取 references/xhs_trend_data_format.md。脚本路径相对于技能目录：scripts/fetch_explosive_covers.py。