Security checks across malware telemetry and agentic risk
This RedNote automation skill is not clearly malicious, but it needs Review because it can control a live social account and Mac UI, send/post/delete content, and capture screens without strong built-in confirmations.
Install only if you are comfortable giving Terminal system-wide Accessibility control and letting an agent operate your live RedNote account. Keep tool approval enabled, verify the visible target before sending DMs, posting or replying to comments, following accounts, or deleting comments, and avoid unattended runs. Treat screenshots and clipboard use as sensitive, consider a dedicated macOS/RedNote account, and do not permanently disable your screensaver or screen lock.
b = get_window_bounds()
if not b:
return None
r = subprocess.run(
["/usr/sbin/screencapture", "-x", f"-l{b['id']}", path],
capture_output=True)
return path if r.returncode == 0 else Nonedef type_text(text: str, delay: float = 0.4):
"""输入文字 — 用剪贴板粘贴，避免中文输入法问题"""
# 1. 把文字写入剪贴板
subprocess.run(["pbcopy"], input=text.encode("utf-8"))
time.sleep(0.1)
# 2. Cmd+V 粘贴
subprocess.run(["osascript", "-e",IMG_W, IMG_H = 708, 736
# 先清空剪贴板
subprocess.run(["pbcopy"], input=b"")
# 1. 点击底部「分享」按钮（截图坐标约 505, 688）
share_x = int(b["x"] + 505 * b["w"] / IMG_W)click_global(copy_x, copy_y, delay=1.0)
# 3. 读剪贴板
result = subprocess.run(["pbpaste"], capture_output=True, text=True)
raw = result.stdout.strip()
# 提取 URL（格式：文字 + URL + 文字）out_path = "/tmp/xhs_imgs/note_img_0.png"
if note_type == "video":
# 全窗口截图
subprocess.run(["/usr/sbin/screencapture", "-x",
f"-l{b['id']}", out_path])
else:
# 图片在左侧 ~45%y = int(b["y"] + 28)
w = int(b["w"] * 0.47)
h = int(b["h"] - 28 - 87)
subprocess.run(["/usr/sbin/screencapture", "-x",
"-R", f"{x},{y},{w},{h}", out_path])
return [out_path] if os.path.exists(out_path) else []ytdlp = shutil.which("yt-dlp") or "yt-dlp"
cmd = [ytdlp, "-o", f"{output_dir}/%(id)s.%(ext)s",
"--write-info-json", "--no-playlist", url]
r = subprocess.run(cmd, capture_output=True, text=True, timeout=120)
# 找下载的视频文件
for ext in ("mp4", "mov", "webm", "flv", "m4v"):
files = glob.glob(f"{output_dir}/*.{ext}")65/65 vendors flagged this skill as clean.