fastfish-format(article-wechat-xhs-format)

PassAudited by ClawScan on May 1, 2026.

Overview

This is a disclosed article-formatting skill that uses a local Python CLI; review the third-party GitHub repo and optional API keys before use.

This skill appears coherent and disclosed for article formatting. Before installing, trust-check the linked GitHub repository, pin a release tag, run it in an isolated Python environment, and only provide API keys if you choose to use related image-generation workflows.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing the companion project can execute third-party Python package code on the user’s machine.

Why it was flagged

The skill relies on external GitHub code and pip installation. This is disclosed and purpose-aligned, but users should still verify the repository and dependencies before installing.

Skill content

本 Skill 会指导安装并运行来自 GitHub 的第三方仓库。供应链风险：clone + pip install 会执行外部代码... 建议使用 release tag 固定版本

Recommendation

Install only from a trusted release tag, inspect requirements.txt, and use a virtual environment or container rather than running as root.

Low

#ASI05: Unexpected Code Execution

What this means

The agent may run the local formatting CLI to process selected article content files.

Why it was flagged

The skill explicitly uses local command execution to run a Python CLI. The behavior is central to the skill and constrained to one documented script.

Skill content

必须使用 `system.run` 执行脚本命令... system.run 仅执行本 Skill 文档列出的脚本 - 允许：`ffformat_cli.py`

Recommendation

Confirm the installed CLI path is trusted and keep agent execution limited to the documented ffformat_cli.py commands.

Low

#ASI03: Identity and Privilege Abuse

What this means

If configured, these API keys can authorize provider usage and possible account charges for image-generation workflows.

Why it was flagged

The main formatting skill requires no credentials, but optional related image-generation workflows may use provider API keys.

Skill content

无必需凭证；配图/生图需对接 baoyu-skills 时，配置 OPENAI_API_KEY 或 GOOGLE_API_KEY 或 DASHSCOPE_API_KEY

Recommendation

Only configure provider keys when needed, keep them in .env, and do not paste or expose them in chat output.