xhs-explosive-detector（小红书爆款雷达）
PassAudited by VirusTotal on May 10, 2026.
Overview
Type: OpenClaw Skill Name: xhs-explosive-detector Version: 1.0.2 The skill bundle contains a Python script `scripts/fetch_xhs_trends.py` that implements a custom HTTPS client using raw sockets and explicitly disables SSL certificate verification and hostname validation (`ssl.CERT_NONE`). This is a significant security vulnerability that allows for Man-in-the-Middle (MitM) attacks when communicating with the external API at `onetotenvip.com`. While the script's logic aligns with its stated purpose of fetching Xiaohongshu trend data, the use of insecure network configurations and a non-standard HTTPS implementation is risky, although no clear evidence of intentional malice or data exfiltration was found.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
A network attacker or misconfigured proxy could impersonate the API and alter rankings, links, or report contents shown to the user.
The script deliberately disables TLS certificate verification and hostname checking when fetching the external API, so the agent cannot authenticate the server it is trusting for report data.
context.check_hostname = False context.verify_mode = ssl.CERT_NONE ssl_sock = context.wrap_socket(sock, server_hostname=None)
Do not rely on this skill for important decisions until TLS verification is fixed; the maintainer should use verified HTTPS, for example requests with verify enabled or ssl.create_default_context with server_hostname set.
Search terms, dates, and potentially business-sensitive content-planning interests may be visible to the external API provider.
User-supplied keywords and dates are sent to a hardcoded third-party provider domain; this is aligned with the skill's purpose, but the provider boundary is not clearly named in the user-facing documentation.
base_url = "https://onetotenvip.com/skill/cozeSkill/getXhsCozeSkillData"
params = {"keyword": keyword, "source": "小红书爆款笔记洞察new-ClawHub"}Use non-confidential query terms unless you trust the provider, and ask the maintainer to document the API provider, data handling, and retention expectations.