v1.0.0

XiaoHongShu

BenignClawScan verdict for this skill. Analyzed May 1, 2026, 7:59 AM.

Analysis

This appears to be a simple Xiaohongshu-style writing helper, with minor npm install/dependency hygiene issues to notice if you run the included code.

GuidanceSafe to consider as a prompt-style writing helper. If you only want Xiaohongshu copywriting assistance, you can use the skill instructions without running the npm package. If you do run the code, review the npm dependency and be aware that the package defines an install lifecycle script.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Agentic Supply Chain Vulnerabilities

SeverityLowConfidenceHighStatusNote

package.json

"dependencies": { "@ai-sdk/google": "^1.0.0" }

The package declares an external npm dependency with a caret version range, so running npm install may fetch third-party code versions not fully represented in the provided artifacts.

User impactIf you run the included npm project, you rely on the npm package supply chain in addition to the skill text itself.

RecommendationPrefer pinned dependency versions with a complete lockfile, and review npm dependencies before running the code.

Unexpected Code Execution

SeverityLowConfidenceHighStatusNote

package.json

"scripts": { "install": "npm install", "start": "node content-creator/index.js" }

An npm install lifecycle script is present. Although it only reinvokes npm install and no malicious command is shown, lifecycle scripts can run automatically during package installation.

User impactRunning npm install may execute an extra install command before you use the tool, which is unnecessary for the content-writing purpose and could surprise users.

RecommendationRemove the install lifecycle script or clearly document why it is needed; users who only need the prompt-based skill do not need to run the package.