龙虾内容工厂

• Analyzed: Mar 28, 2026, 10:21 PM
• Findings: 1
• Version: 1.0.0
• Hash: 9103b82f0cf944c3ca861b71e70515f64289781782b025d17df9f7e455eb4acb
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle automates content creation and posting to Xiaohongshu (XHS) using Playwright and FFmpeg, but contains several high-risk flaws and vulnerabilities. Specifically, `publish-xhs.js` uses a hardcoded absolute path to a specific user's home directory (`/Users/houdaliang/`) to load Playwright and employs `innerHTML` injection to set post content without sanitization, which could lead to self-XSS. Furthermore, `generate-today.py` references a hardcoded path for a different skill name (`xhs-smart-post`), indicating poor packaging or unintentional bugs. While the browser automation via CDP (port 18800) is aligned with the stated purpose, these implementation flaws and the control of a logged-in session represent significant security risks.