The Agent Skills Directory

[SAFE]: The skill performs its stated function of automating Xiaohongshu posts without any detected malicious patterns.
[EXTERNAL_DOWNLOADS]: The skill requires standard dependencies including xhs-kit, requests, and playwright. These are expected for its documented purpose of content automation and browser-based publishing.
[COMMAND_EXECUTION]: The skill executes local Python and Bash scripts to handle image generation and uses the xhs-kit command-line tool for publishing. Command execution is handled using standard parameter passing and proper shell quoting to mitigate injection risks.
[CREDENTIALS_UNSAFE]: No hardcoded secrets were identified. The skill correctly instructs users to manage sensitive API keys via environment variables (e.g., GOOGLE_API_KEY, SEED_API_KEY), which is a secure practice.
[DATA_EXFILTRATION]: While the skill transmits user-derived content to external endpoints (Google Gemini and ByteDance Seed), this behavior is the primary intended functionality for image generation. The target services are well-known technology providers.

xhs-auto