Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

PigBun RedNote

v0.8.1

小红书AI运营工具,支持搜索、发布笔记,评论管理,社交互动及数据分析的一站式自动化解决方案。

0· 541·0 current·0 all-time
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The skill advertises Xiaohongshu (小红书) automation (search, publish, comment, analytics) and its instructions require an API key from pigbunai.com plus Playwright and a browser QR-login. Those dependencies are plausible for a web-automation/integration skill, but pigbunai.com is an intermediary service (not the official platform) and the SKILL.md provides no provenance or guarantees about what that third party does with requests or data.
Instruction Scope
Instructions are concrete (install Playwright, obtain API key, run `openclaw rednote init` to scan and login). They do not ask the agent to read unrelated system files or environment variables. However, they are vague about what `openclaw rednote init` does (where session tokens are stored, whether credentials or cookies are transmitted to pigbunai.com, retention policy), which matters because the skill will act on the user's account (publish/delete/comment).
Install Mechanism
This is an instruction-only skill with no install spec or code files — lowest install risk. It tells the user to run `npx playwright install chromium`, which is a normal requirement for browser automation and not itself suspicious. No downloads from unknown URLs or archive extraction are specified by the skill.
!
Credentials
The skill asks the user to supply an API key from pigbunai.com in the OpenClaw plugin config (not via environment variables). Requesting an API key for a third‑party service that proxies Xiaohongshu is proportionate for this functionality, but because the key grants remote control over operations (search, publish, comment) and the SKILL.md offers no details on the key's scope or what data pigbunai.com will see/store, this is a potential credential/exfiltration concern. The registry metadata shows no declared required env vars, so there is no explicit listing of where secrets are stored or protected.
Persistence & Privilege
always:false (normal). The skill requires an interactive QR login step which likely creates persistent session tokens allowing future automated actions; the skill does not describe how/session tokens are stored or how to revoke them. Autonomous invocation is allowed by default (not flagged by itself) — combined with stored session tokens and a third‑party API, this could permit ongoing actions on the user's account if not carefully managed.
What to consider before installing
This skill appears to do what it says (web automation for 小红书) but depends on a third‑party service (pigbunai.com) and an interactive QR login whose token storage/handling are unspecified. Before installing: 1) Verify pigbunai.com is trustworthy (company, privacy/terms, contact); 2) Ask the skill/vendor for source code or a clear description of what `openclaw rednote init` stores and where session tokens/API requests are sent; 3) Use a throwaway or test Xiaohongshu account when first trying it; 4) Limit the plugin to specific tasks and disable it when not needed; 5) Check OpenClaw plugin config storage and rotation/revocation options for the apiKey; 6) Avoid giving it high-value accounts (payment info, business accounts) until you confirm behavior; 7) If you need a higher assurance, request a signed/hosted implementation or audited code before use.

Like a lobster shell, security has layers — review code before you run it.

latestvk97eb62xkb7ncxq5d78pxmbdwx81t5qz
541downloads
0stars
2versions
Updated 9h ago
v0.8.1
MIT-0

PigBun RedNote

小红书 AI 运营工具 —— 搜索、发布、分析、互动,一站式自动化。

功能概览

本技能为 OpenClaw 提供 27 个小红书工具,覆盖内容创作、社交互动和数据分析全流程。

前置要求

  1. pigbunai.com 获取免费 API Key(每天 50 次调用)
  2. 安装 Playwright:npx playwright install chromium
  3. 首次使用前运行 openclaw rednote init 扫码登录小红书

工具列表

搜索与内容获取

工具说明
search_notes根据关键词搜索笔记
get_note_content获取笔记详细内容
get_note_comments获取笔记评论列表

发布笔记

工具说明
publish_note发布图文笔记(至少 1 张图片)
publish_note_video发布视频笔记
publish_note_text发布纯文字笔记(自动生成封面)
publish_note_article发布长文笔记(标题无字数限制)

笔记管理

工具说明
get_my_notes获取自己的笔记列表
edit_note编辑已发布笔记的标题、正文、标签
delete_note删除已发布的笔记

评论互动

工具说明
comment_note在笔记下发表评论
reply_comment回复指定评论
filter_comments评论情感分类(正面/负面/问题/建议/中性)

社交互动

工具说明
like_note给笔记点赞
collect_note收藏笔记
follow_author关注笔记作者

数据分析

工具说明
get_dashboard_overview创作者数据总览(曝光、观看、互动、涨粉)
get_content_analytics每篇笔记的详细数据
get_fans_analytics粉丝数据(总量、新增/流失、画像)
discover_trending发现热门话题(多关键词热度对比)
analyze_best_publish_time分析最佳发布时间
generate_content_report生成综合运营报告
get_inspiration_topics获取灵感话题(含参与人数、浏览量)
get_activity_center获取官方活动列表(流量扶持、奖励)

其他

工具说明
login浏览器登录小红书
get_notifications获取通知消息(评论、点赞、关注)
get_share_link获取笔记分享链接

使用示例

搜索笔记:

搜索关键词"咖啡推荐"的热门笔记

发布笔记:

帮我发布一篇关于今日早餐的图文笔记,标题"元气早餐分享",配上这张图片 /path/to/photo.jpg

数据分析:

生成我最近 7 天的运营报告

评论管理:

帮我查看最新笔记的评论,筛选出提问类评论并逐一回复

配置

在 OpenClaw 插件配置中设置 API Key:

{
  "plugins": {
    "entries": {
      "pigbun-rednote": {
        "enabled": true,
        "config": {
          "apiKey": "pb_live_your_key_here"
        }
      }
    }
  }
}

链接

Comments

Loading comments...