xiaohongshu-post-generator

SUSPICIOUS: the skill's core purpose matches social-post generation, but its actual data flow relies on a third-party DeepNLP/OneKey gateway that receives the API key, prompts, images, and design data instead of using first-party service APIs directly. Install trust is moderate rather than extreme because the CLI is vendor-documented and npm-published, but the proxy-centered architecture and credential forwarding make the overall risk medium-high.