Security checks across malware telemetry and agentic risk
The skill mostly matches its XiaoHongShu automation purpose, but it needs review because it can change account state, includes underdocumented engagement-manipulation code, logs session cookies, and uses unsafe config execution.
Install only if you understand that this can use a XiaoHongShu session cookie to act as your account. Avoid important accounts, do not paste cookies into shared logs or chats, and review or remove the read-count metrics workflow, comment mutation APIs, session-cookie logging, and eval-based config parser before using it in production.
"""
获取配置项的通用方法
"""
return eval(self.config.get(section, key, fallback=fallback))
# 单例模式
xhs_config = Config()66/66 vendors flagged this skill as clean.