Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

XHS Video Downloader

v1.0.0

Download videos from Xiaohongshu (小红书) pages. Use when the user wants to save or download a video from a xiaohongshu.com URL, or mentions "小红书视频下载", "保存小红书视频...

0· 603·1 current·1 all-time
byKINO@hviktortsoi
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
Name/description (download Xiaohongshu videos) matches the provided SKILL.md and the included Python script. Nothing in the repo requests unrelated credentials or system access.
Instruction Scope
SKILL.md confines actions to loading the Xiaohongshu page (optionally via browser automation), running a small JS snippet to find .mp4/xhscdn URLs, and downloading with curl or the included Python script. The JS snippet and script only target page HTML and CDN URLs; they do not read unrelated files or environment variables. Note: the browser automation step executes JS in the page context (expected for extracting rendered SPA content).
Install Mechanism
No install spec (instruction-only) which limits installation risk. The included Python script depends on the third‑party 'requests' package but the skill does not provide an automated install step—user must pip install requests themselves. No downloads from untrusted URLs or archive extraction are present.
Credentials
The skill requires no credentials, config paths, or environment variables. It performs outbound HTTP(S) requests to the target Xiaohongshu page and to CDN URLs (expected for downloading video content). It writes files to ~/Downloads/xiaohongshu by default (reasonable for a downloader).
Persistence & Privilege
Skill is not always-on and does not request elevated or persistent privileges. It does not modify other skills or global agent settings.
Assessment
This skill appears to do exactly what it claims: fetch a Xiaohongshu page, find the CDN/video URL, and download the file. Before installing/using it: 1) Be sure downloading the video complies with Xiaohongshu's terms and copyright law. 2) You must have Python3 and the 'requests' package (pip install requests) to run the script; the SKILL.md does not auto-install dependencies. 3) The tool will make network requests to whatever URL you supply and save files to ~/Downloads/xiaohongshu — do not pass untrusted or unknown URLs. 4) For pages requiring JS rendering, follow the browser automation method (it runs a small JS snippet in the page context to locate .mp4 URLs). 5) If you need stronger assurances, inspect or run the Python script in a sandbox before use.

Like a lobster shell, security has layers — review code before you run it.

latestvk971r69zyrzekhhxs278xaf19n81z9q2
603downloads
0stars
1versions
Updated 9h ago
v1.0.0
MIT-0

Xiaohongshu Video Downloader

Download videos from Xiaohongshu (小红书) by extracting the real CDN URL from the page.

How It Works

Xiaohongshu videos use blob URLs in the browser, which cannot be downloaded directly. This skill:

  1. Uses browser automation to load the page (required for JS rendering)
  2. Extracts the real CDN video URL from the page HTML
  3. Downloads the video with proper headers

Method 1: Browser Automation (Recommended)

Use the browser tool to extract the video URL:

  1. Navigate to the Xiaohongshu page:
browser action=navigate targetUrl="https://www.xiaohongshu.com/explore/NOTE_ID"
  1. Extract the video URL with JavaScript:
(() => {
  const html = document.documentElement.outerHTML;
  const mp4Matches = html.match(/https?:\/\/[^"\s]+\.mp4[^"\s]*/g);
  if (mp4Matches) return [...new Set(mp4Matches)];
  return null;
})()
  1. Download with curl:
curl -L -o output.mp4 "<VIDEO_URL>" \
  -H "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36" \
  -H "Referer: https://www.xiaohongshu.com/"

Method 2: Python Script

For pages that don't require authentication:

python3 scripts/download_video.py "https://www.xiaohongshu.com/explore/NOTE_ID"

Note: The Python script may not work for all pages due to:

  • JavaScript rendering requirements
  • Authentication/login requirements
  • Rate limiting

Notes

  • Videos are typically hosted on xhscdn.com CDN
  • User-Agent and Referer headers are required to avoid 403 errors
  • Output directory: ~/Downloads/xiaohongshu/
  • Video URLs follow pattern: https://sns-video-*.xhscdn.com/stream/.../*.mp4

Comments

Loading comments...