Xiaohongshu Crawler
v1.0.1小红书内容爬取工具，支持搜索笔记（需要登录）、获取笔记详情、用户信息、热门笔记等公开内容爬取功能。
⭐ 2· 2.5k·12 current·12 all-time
by@djttt
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
Name/description (Xiaohongshu crawler) align with the included scripts and libraries: Playwright-based browser automation, search/deep-crawl/get-note/get-user/hot-notes scripts, anti-crawl logic and caching. Dependencies (playwright, axios, cheerio) and the presence of stealth/anti-crawl code are expected for this purpose.
Instruction Scope
SKILL.md and the scripts instruct the agent/user to open a browser, capture session cookies, and write them into config.json; scripts read config.json, use cookies to access logged-in-only content, and write output files and caches. Collecting and persisting session cookies is sensitive and outside 'purely read-only' behavior—it's necessary for logged-in scraping but should be highlighted to users.
Install Mechanism
There is no explicit install spec in the registry entry (instruction-only), but package.json lists Playwright which will pull browser binaries and increase disk/network activity when dependencies are installed. No downloads from unknown ad-hoc URLs or obfuscated installers are present in the provided files.
Credentials
The skill requests no environment variables or external credentials, which is coherent. However, it asks the user to export and store their Xiaohongshu session cookies (and config may contain proxy server credentials) into a local config.json in plaintext; that is sensitive and should be treated as such. The number/nature of requested items is proportionate to a scraper but still security-relevant.
Persistence & Privilege
The skill is not marked always:true and does not modify other skills or global agent settings. It writes/reads its own config.json and cache files in its workspace, which is normal for a CLI scraper.
Assessment
This skill appears to be what it says: a Playwright-based Xiaohongshu scraper. Important cautions before installing/running: 1) get-cookie.js extracts your account session cookies and saves them to config.json in plaintext—do not use your primary/personal account if you are concerned about compromise or violating platform rules; prefer a throwaway/test account. 2) Review config.json before running — it can contain proxy credentials and stored cookies. 3) Installing dependencies (playwright) will download browser binaries; run npm install in a sandboxed environment if you want to limit exposure. 4) The tool includes anti-detection and proxy-rotation features; aggressive or large-scale crawling can violate site terms and may lead to account suspension—follow the usage limits documented in SKILL.md. 5) If you need higher assurance, request the missing files not shown here (4 files were truncated) and confirm there is no hidden network exfiltration before running on sensitive accounts.Like a lobster shell, security has layers — review code before you run it.
latestvk973ac84q691rtq83e3w7j7r2s831hgv
License
MIT-0
Free to use, modify, and redistribute. No attribution required.