Xhs Auto Publisher

• Analyzed: May 4, 2026, 11:16 AM
• Findings: 1
• Version: 0.1.0
• Hash: 1efab7df97867a0b3878d0a56551f75e09a76f2adeb889df3771c774181a3974
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is a comprehensive automation tool for generating and publishing Xiaohongshu content. It uses Puppeteer (scripts/publish_xhs.js and scripts/render_slides.js) to render HTML templates into images and automate the browser-based posting process. Key security features include local storage of authentication data (cookies and browser profiles) in a hidden '.auth' directory and a 'semi-automatic' design that requires the user to manually click the final 'Publish' button to mitigate account ban risks. No evidence of data exfiltration, malicious execution, or harmful prompt injection was found; the instructions explicitly direct the agent to keep sensitive data local and avoid unauthorized uploads.