Xiaohongshu CN

Security checks across malware telemetry and agentic risk

Overview

This is an instruction-only Xiaohongshu research guide; it is coherent but points users to third-party scraping methods that should be reviewed before use.

Before installing or using this skill, understand that it does not provide a reviewed built-in integration. If you follow its recommendations, you may be running third-party scraping software or using packet-capture methods, so review those tools separately, avoid exposing account/session data, and keep scraping activity limited and compliant.

VirusTotal

57/57 vendors flagged this skill as clean.

View on VirusTotal

Risk analysis

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

#
ASI04: Agentic Supply Chain Vulnerabilities
Low
What this means

Running the recommended crawler could execute code and dependencies from an external project that this package does not control.

Why it was flagged

The skill directs users to clone, install dependencies for, and run a third-party crawler that is not included in the reviewed artifacts and is not pinned to a version.

Skill content
git clone https://github.com/Big-Buffer/XiaohongshuSpider
cd XiaohongshuSpider
pip install -r requirements.txt
python main.py
Recommendation

Inspect the external repository and its dependencies, pin a trusted commit if possible, and run it only in an environment you are comfortable using for scraping.

#
ASI02: Tool Misuse and Exploitation
Low
What this means

These methods can be fragile, may run into platform limits, and could affect an account if used too aggressively.

Why it was flagged

The documented workflow relies on scraping, packet capture, or reverse-engineering rather than a scoped official API.

Skill content
小红书没有公开 API,需要以下方式之一: ... 网页爬虫 ... 小程序抓包 ... 注意: 小红书 API 需要逆向工程
Recommendation

Use only user-approved, low-rate, compliant collection methods; avoid capturing or exposing account/session data; and follow the skill’s own cautions about robots.txt and request frequency.