xiaohongshu-writer
Pass
Audited by Gen Agent Trust Hub on Apr 13, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The script in scripts/main.py invokes the fc-match system utility on Linux platforms to resolve font paths for Chinese characters. This call uses a static list of arguments and does not incorporate external or user-provided data.
- [EXTERNAL_DOWNLOADS]: The skill depends on the playwright and Pillow Python packages and performs a standard download of the Chromium browser engine as part of the tool's required setup.
- [PROMPT_INJECTION]: User-provided strings for titles and descriptions are sanitized using html.escape() before being embedded into an HTML template for thumbnail generation, preventing the execution of unintended formatting or scripts during the rendering process.
- [DATA_EXFILTRATION]: No unauthorized network activity or sensitive file access was detected. The skill reads input from standard streams and writes generated image files to a local output directory.
Audit Metadata