rednote-contacts

• Risk level: Low
• Analyzed: Apr 30, 2026, 5:12 AM
• Findings: 0
• Version: 1.1.0

Overview

The skill is a coherent wrapper around a local red-crawler CLI and Playwright-based browser sessions; its requirements and runtime behavior mostly match its documentation, with a few minor metadata and privilege notes for the user to consider.

This skill is a wrapper that expects a legitimate red-crawler CLI and a Playwright runtime. Before installing: 1) ensure you actually have or trust the red-crawler binary referenced by runner_command (the skill will call whatever you configure there); 2) treat any Playwright storage-state JSON and browser_auth strings as sensitive (they contain authenticated session data) and keep them local and private; 3) avoid setting runner_command to untrusted binaries or paths, since that lets the skill execute arbitrary commands; 4) confirm you are allowed to collect contact data from the target site; and 5) note a minor metadata mismatch: some registry metadata listed no required binaries while the manifest and SKILL.md indicate the red-crawler binary is required — verify the binary is present and from a trusted source.