Skills guizang-social-card-skill

📦

guizang-social-card-skill

Name: guizang-social-card-skill
Author: op7418

Content revision r1 Medium Risk ⚙️ External commands🌐 Network access📁 Filesystem access

Create Guizang Social Cards

Social posts often need strong visual structure, not just text on a canvas. This skill turns articles, screenshots, photos, and short videos into platform-ready card layouts.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "guizang-social-card-skill" from https://skillstore.io/skills/op7418-guizang-social-card-skill.md and its manifest at https://skillstore.io/api/skills/op7418-guizang-social-card-skill/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/op7418-guizang-social-card-skill.md Signed manifest GET /api/skills/op7418-guizang-social-card-skill/manifest Signed lockfile GET /api/skills/op7418-guizang-social-card-skill/lockfile

Test it

Using "guizang-social-card-skill". A product update article with three screenshots and a short launch title.

Expected outcome:

A Swiss-style five-page carousel with a bold cover, screenshot evidence pages, a feature comparison page, and an output folder for rendered PNGs.

Using "guizang-social-card-skill". A WeChat essay title and a short summary about an AI workflow review.

Expected outcome:

A paired cover system with a wide main cover, a simplified square share card, and a preview layout for checking visual consistency.

Using "guizang-social-card-skill". Three short travel clips and a request for a motion card with little text.

Expected outcome:

A material-first Live Photo plan using three video wells, a static first-frame check, and delivery notes for the JPG, MOV, and mobile publishing package.

Security Audit

Medium Risk

v4 • 7/9/2026 Open versioned report

Most static findings are false positives from Markdown code spans, CSS class names, design terminology, relative asset URLs, and legitimate local validation scripts. Confirmed issues are limited to remote template dependencies, public web image fetching, Mapbox network usage, and a curl-based asset workflow. Additional semantic review found token-handling and third-party package execution risks in the map and Live Photo workflows.

Files scanned

9,783

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (2)

Medium

references/map-component.md:19-31

Map API Token Exposure Risk

The map component guidance builds Mapbox Static image URLs with an access_token query parameter. Generated HTML or provenance files can expose scoped map tokens if shared or committed.

The documentation explicitly requires MAPBOX_ACCESS_TOKEN and shows the token embedded in an image URL. The risk depends on generated artifact handling, but the exposure path is clear.

Medium

references/live-photo-production.md:209-228 scripts/package-live-photo.py:6-8

Third-Party Package Execution For Live Photo Packaging

The Live Photo workflow uses uvx and makelive to execute third-party package code during packaging. Some examples omit the pinned version even though the text recommends pinning.

The commands are documented and the wrapper imports makelive directly. This is legitimate functionality, but it introduces package supply-chain risk and should be pinned and confirmed.

Capability review items (14)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

assets/template-swiss-card.html:10

Hardcoded URL

The Swiss seed template loads lucide from unpkg at render time, which executes third-party JavaScript in the browser context. This is an intentional dependency but remains a supply-chain and network exposure risk.

Medium

SKILL.md:272

Ruby/shell backtick execution

- Use WebFetch or `curl` to download the image into the task folder's `assets/` directory.

This line explicitly permits using curl to download web images into task assets. The command is task-scoped, but it is real external command and network behavior.

Low

assets/template-editorial-card.html:7

Hardcoded URL

The editorial seed template loads Google Fonts from external hosts when rendered. This is expected for typography, but it creates network egress and a remote dependency.

Low

assets/template-editorial-card.html:8

Hardcoded URL

The editorial seed template loads Google Fonts from external hosts when rendered. This is expected for typography, but it creates network egress and a remote dependency.

Low

assets/template-editorial-card.html:9

Hardcoded URL

The editorial seed template loads Google Fonts from external hosts when rendered. This is expected for typography, but it creates network egress and a remote dependency.

Low

assets/template-swiss-card.html:7

Hardcoded URL

The seed template loads Google Fonts from external hosts when rendered. This is expected for typography, but it creates network egress and a remote dependency.

Low

assets/template-swiss-card.html:8

Hardcoded URL

The seed template loads Google Fonts from external hosts when rendered. This is expected for typography, but it creates network egress and a remote dependency.

Low

assets/template-swiss-card.html:9

Hardcoded URL

The seed template loads Google Fonts from external hosts when rendered. This is expected for typography, but it creates network egress and a remote dependency.

Low

references/map-component.md:22

Hardcoded URL

https://api.mapbox.com/styles/v1/mapbox/light-v11/static/

The map reference documents Mapbox Static image URLs for real route rendering. This is intentional map functionality, but it relies on a third-party network service.

Low

references/map-component.md:31

Hardcoded URL

<img src="https://api.mapbox.com/styles/v1/mapbox/light-v11/static/.../1200x675@2x?access_token=..."

The map reference documents Mapbox Static image URLs for real route rendering. This is intentional map functionality, but it relies on a third-party network service.

Low

SKILL.md:262

Hardcoded URL

1. **Unsplash** — `https://unsplash.com/s/photos/<keyword>`. Strong for outdoor / lifestyle / atmosp

SKILL.md recommends public image-source sites for web-sourced assets. This is user-facing workflow guidance, but it can cause external network access during card production.

Low

SKILL.md:263

Hardcoded URL

2. **Pexels** — `https://www.pexels.com/search/<keyword>/` or `https://www.pexels.com/zh-cn/search/<

SKILL.md recommends public image-source sites for web-sourced assets. This is user-facing workflow guidance, but it can cause external network access during card production.

Low

SKILL.md:264

Hardcoded URL

3. **Flickr CC-licensed pool** — `https://www.flickr.com/search/?text=<keyword>&license=2%2C3%2C4%2C

SKILL.md recommends public image-source sites for web-sourced assets. This is user-facing workflow guidance, but it can cause external network access during card production.

Low

SKILL.md:265

Hardcoded URL

4. **Wallhaven** — `https://wallhaven.cc/search?q=<keyword>`. Strong for game / anime / wallpaper th

SKILL.md recommends public image-source sites for web-sourced assets. This is user-facing workflow guidance, but it can cause external network access during card production.

Risk Factors

⚙️ External commands (50)

🌐 Network access (24)

📁 Filesystem access (50)

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/op7418-guizang-social-card-skill/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/op7418-guizang-social-card-skill/security.svg)](https://skillstore.io/skills/op7418-guizang-social-card-skill?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/op7418-guizang-social-card-skill?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/op7418-guizang-social-card-skill/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/op7418-guizang-social-card-skill.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

op7418. (2026). guizang-social-card-skill security audit report (audit version 4) [Author version unspecified]. Skillstore. https://skillstore.io/skills/op7418-guizang-social-card-skill/audits/4

BibTeX citation

@techreport{op7418-op7418-guizang-social-card-skill-2026,
  author = {op7418},
  title = {guizang-social-card-skill security audit report (audit version 4)},
  institution = {Skillstore},
  year = {2026},
  number = {4},
  url = {https://skillstore.io/skills/op7418-guizang-social-card-skill/audits/4},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "guizang-social-card-skill security audit report (audit version 4)"
version: "unspecified"
type: report
authors:
  - name: "op7418"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/op7418-guizang-social-card-skill/audits/4"
identifiers:
  - type: other
    value: "skillstore:op7418-guizang-social-card-skill:audit:4"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Turn Articles Into Rednote Carousels

Convert a long article or product note into a focused 3:4 carousel with a cover, supporting pages, and clear visual hierarchy.

Create WeChat Cover Pairs

Design a 21:9 official account cover and a matching 1:1 share card from the same source title and theme.

Package Short Motion Cards

Plan a Live Photo card from short videos, inspect the first frame, and prepare still and motion assets for mobile publishing.

Try These Prompts

Beginner Carousel

Create a five-page Xiaohongshu carousel from this article. Use a clear cover, one idea per page, and choose Editorial or Swiss style based on the content.

Screenshot Tutorial

Turn these product screenshots into a Rednote tutorial carousel. Keep the UI readable, use screenshot framing, and avoid decorative elements that do not explain the workflow.

WeChat Cover System

Create a WeChat Official Account cover pair for this title and summary. Make one 21:9 main cover and one matching 1:1 share card with a shorter title.

Advanced Live Photo Card

Use these short clips to create a Xiaohongshu Live Photo card. First choose single, grid, or triple collage structure, then inspect the first frame before packaging the motion output.

Best Practices

Start with the target platform, source material, and visual evidence before choosing a layout.
Use user-supplied images or screenshots when possible, and record provenance for any web-sourced assets.
Inspect rendered outputs for text overflow, crop safety, readable screenshots, and platform dimensions before delivery.

Avoid

Do not create generated work in the skill root or mix task artifacts with the installed skill files.
Do not force every page into the same title-plus-card structure when the content needs varied layouts.
Do not use Live Photo production terms as visible audience copy unless the post teaches that production process.