Security checks across malware telemetry and agentic risk
This skill appears intended to automate Rednote/Xiaohongshu, but it can read private content and perform account-changing social actions without clear built-in confirmation or privacy controls.
Install only if you are comfortable granting the skill Accessibility-level control over your Mac and logged-in Rednote account. Before using it, review which tools can send messages, post or delete comments, read DMs, capture screenshots, and touch the clipboard; avoid sensitive conversations or clipboard contents during use, and require your agent to ask for explicit approval before any outbound or destructive action.
def type_text(text: str, delay: float = 0.4):
"""输入文字 — 用剪贴板粘贴，避免中文输入法问题"""
# 1. 把文字写入剪贴板
subprocess.run(["pbcopy"], input=text.encode("utf-8"))
time.sleep(0.1)
# 2. Cmd+V 粘贴
subprocess.run(["osascript", "-e",IMG_W, IMG_H = 708, 736
# 先清空剪贴板
subprocess.run(["pbcopy"], input=b"")
# 1. 点击底部「分享」按钮（截图坐标约 505, 688）
share_x = int(b["x"] + 505 * b["w"] / IMG_W)click_global(copy_x, copy_y, delay=1.0)
# 3. 读剪贴板
result = subprocess.run(["pbpaste"], capture_output=True, text=True)
raw = result.stdout.strip()
# 提取 URL（格式：文字 + URL + 文字）ytdlp = shutil.which("yt-dlp") or "yt-dlp"
cmd = [ytdlp, "-o", f"{output_dir}/%(id)s.%(ext)s",
"--write-info-json", "--no-playlist", url]
r = subprocess.run(cmd, capture_output=True, text=True, timeout=120)
# 找下载的视频文件
for ext in ("mp4", "mov", "webm", "flv", "m4v"):
files = glob.glob(f"{output_dir}/*.{ext}")59/59 vendors flagged this skill as clean.