Skills/ClawHub/xhs-content-engine

xhs-content-engine@0.3.4

CAUTION· static only

Publisher claims: "小红书内容引擎。两种 mode：①拆解（v1）— 输入 XHS 爆款链接，输出 18 维结构化拆解卡；②生成（v2）— 在拆解卡基础上结合品牌信息，用 Ofox（LLM + Nano Banana）生成我方版本的脚本/文案/素材图/封面/标签全套产出。视频生成（Seedance 2.0）规划在 v2.1。同时维护..." Observed in sandbox: static analysis only — behavior not yet observed.

Registry ClawHubPublisher dizhu · publishing for 158 daysInstalls 739Last detonated 3d ago
What would fix thisWatchDispute verdict

Coverage

Static only; nothing was run yet.

The label rests on the code, the instruction files and the publisher. The honeypot run replaces this verdict when it completes.

Is [email protected] safe to install?

KillerSkills analysed it statically (a sandbox run is pending) on 2026-11-11 and scored it 52/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Access to sensitive file paths. Summary: static analysis only — behavior not yet observed.

Behavior trace

Queued for honeypot run · static analysis only
t+CategoryObserved action

This version has not been detonated yet. The score above counts behavior as unknown (50/100), so it cannot read Verified until the honeypot run completes and replaces this verdict.

Static findings

HIGH
Access to sensitive file pathsSKILL.md:42 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files- **本地文件读写**：读取 `graph/`、`references/`、`.env` 配置和工作区输入；写入 `docs/deconstructions/`、临时工作区、`note.json`、`comments.json`、抽帧图片、生成脚本、生成图片/视频和质量报告；按 Step 6 只追加回写 `graph/engine/` 与 `graph/platforms/`。Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/content_engine/client.py:43 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system fileslambda: _skill_root_dir() / ".env", # 3. Skill 根目录Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedscripts/content_engine/lookup.py:158 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/content_engine/preflight.py:71 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Access to sensitive file pathsSKILL.md:45 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files- **凭据读取**：只读取显式配置的环境变量或 `.env` 中的 `AGENT_DELU_*`、`OFOX_*`、`OPENROUTER_*`、`ARK_*` 等 provider key；不会把 key 写入输出文件或日志。Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/content_engine/preflight.py:135 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"如使用自建/内网代理，在 .env 设置 AGENT_DELU_BASE_URL=https://your-host"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Privileged sudo commandscripts/content_engine/preflight.py:66 · Privileged sudo command — agent may execute with elevated privileges"Linux: sudo apt install ffmpeg (或 dnf / pacman 对应命令)\n"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsscripts/content_engine/preflight.py:179 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files" 2) 在 .env 加：OFOX_API_KEY=ofox-...\n"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsSKILL.md:555 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesecho 'AGENT_DELU_API_TOKEN=你的_agent_delu_token' >> ~/.config/content-engine/.envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Privileged sudo commandscripts/content_engine/video.py:101 · Privileged sudo command — agent may execute with elevated privileges" Linux: sudo apt install ffmpeg (或 dnf / pacman)\n"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsscripts/content_engine/seedance.py:99 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesf" echo 'ARK_API_KEY=你的_key' >> {config_dir}/.env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/content_engine/preflight.py:206 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files" 3) 在 .env 加：ARK_API_KEY=...\n"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/content_engine/client.py:41 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system fileslambda: Path.cwd() / ".env", # 1. 当前工作目录Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/content_engine/seedance.py:63 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"""env > .env 文件三源（复用 llm.py 的搜索路径）。"""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedscripts/content_engine/video_compose.py:251 · Python subprocess execution detectedsubprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Access to sensitive file pathsscripts/content_engine/llm.py:48 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system fileslambda: _skill_root_dir() / ".env",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packageSKILL.md:612 · npx invocation of non-well-known package — may execute untrusted codenpx -y @larksuite/openclaw-lark installFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathsscripts/content_engine/seedance.py:9 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesstdlib only。ARK_API_KEY 从 env / .env 三源加载（同 OFOX_API_KEY 模式）。Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/content_engine/llm.py:47 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system fileslambda: _xdg_config_dir() / ".env",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/content_engine/client.py:48 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"""按优先级从 env / .env 文件读取第一个命中的配置值。"""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsSKILL.md:558 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesecho 'OFOX_API_KEY=ofox-你的_key' >> ~/.config/content-engine/.envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Privileged sudo commandscripts/extract_xhs.py:43 · Privileged sudo command — agent may execute with elevated privilegesf" Linux: sudo apt install python3.12 (或 pyenv install 3.12)\n"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsSKILL.md:553 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesecho 'AGENT_DELU_BASE_URL=https://agent.delu.cn' >> ~/.config/content-engine/.envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Privileged sudo commandscripts/content_engine/preflight.py:50 · Privileged sudo command — agent may execute with elevated privileges"Linux: sudo apt install python3.12 (或 pyenv install 3.12)\n"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsscripts/content_engine/client.py:42 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system fileslambda: _xdg_config_dir() / ".env", # 2. XDG 标准位置Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/content_engine/llm.py:53 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"""env > .env 文件三源。允许 OPENROUTER_API_KEY 作为兼容备选。"""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/content_engine/llm.py:8 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files- token 走 v1 同款多源解析（env / cwd .env / XDG / skill 根）Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedscripts/content_engine/video.py:111 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Access to sensitive file pathsscripts/content_engine/llm.py:46 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system fileslambda: Path.cwd() / ".env",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/content_engine/client.py:6 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files- token 多源解析：env > XDG config > 项目 .envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_seedance.py:101 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# 临时清空 env / .env 加载（用空字符串 api_key 不行因为有 fallback；用 _load_ark_key mock）Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05

Cost to the agent

Instructions loaded
≈5,301 tok
1 file · 54 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

28 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim dizhu: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  3. Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  4. Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  5. npx invocation of non-well-known package≈ +2 on the totalPin versions and sources; vendor anything fetched at install time.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim dizhuPropose a patch to the maintainer