龙虾内容工厂
ReviewAudited by ClawScan on May 10, 2026.
Overview
The skill mostly does what it claims, but it runs hard-coded code/dependencies outside its own package and uses a logged-in Xiaohongshu browser session for scheduled posting workflows.
Install only if you trust the author and are comfortable automating a Xiaohongshu creator account. Before running it, fix or review the hard-coded external paths, use a dedicated Chrome profile if possible, inspect the generated content, and monitor any cron job you add.
Findings (5)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
A user may think they are running only this skill, but generation can depend on code outside the reviewed package.
The generator hard-codes a helper from a different skill directory instead of using the bundled scripts/make_card.py, so running it may execute unreviewed local code or fail depending on another skill's contents.
MAKE_CARD = os.path.expanduser("~/.openclaw/workspace/skills/xhs-smart-post/scripts/make_card.py")Change this to a relative path inside this skill package, or clearly declare and review the external skill dependency before running it.
The script may not run on other machines, or may rely on environment-specific code outside the skill package.
The publish script imports Playwright from a developer-specific absolute path rather than a normal declared package path.
const { chromium } = require('/Users/houdaliang/.nvm/versions/node/v22.22.1/lib/node_modules/playwright');Use a standard declared dependency such as require('playwright') and document the required version.
If run with the wrong Chrome profile or account, the script can upload and prepare posts under that account.
The skill expects an existing logged-in browser session so the automation can act on the user's Xiaohongshu creator account.
小红书需在 Chrome 中已登录（creator.xiaohongshu.com）
Use a dedicated browser profile/account where possible and verify the final page before publishing.
Wrong file paths, titles, or body text could be uploaded into the creator interface before the user notices.
The script automates a browser upload and directly fills title/body fields in a third-party creator platform.
await fileChooser.setFiles(videoPath); ... nativeSetter.call(el, value); ... el.innerHTML = value.split('\n').map(l => `<p>${l || '<br>'}</p>`).join('');Review generated videos and text before running the publish script, and keep the final manual publish confirmation.
The workflow may keep preparing posts on a schedule after initial setup.
The documented setup creates a scheduled task that can run the posting workflow later.
openclaw cron add --name "小红书-午间发布" --cron "0 12 * * *"
Only add the cron job if you want recurring automation, and remove or pause it when no longer needed.