小红书转Obsidian

This skill appears to do what it says (scrape Xiaohongshu posts and optionally transcribe videos), but exercise caution before installing/using it: - Sensitive cookies: The tool requires you to export your Xiaohongshu cookies (session tokens) and save them to a local JSON file. Those cookies grant access to your account and should be treated like a password — do NOT share them. Consider creating a throwaway account if you are unsure. - Plaintext storage: Cookies are stored in plaintext in your home directory by default; remove or rotate them after use and restrict file permissions (chmod 600) if you keep them. - TLS verification disabled: extract_post.py creates an SSL context with certificate verification disabled (ssl.CERT_NONE). This reduces protection against network-level interception (MITM). If you only run this on trusted networks, risk is lower, but ideally the script should be modified to enable verification. - Inconsistent defaults: SKILL.md and extract_post.py disagree on the default cookie path; always pass explicit --cookies and --output arguments to avoid surprises. - Review code before running: The repository is small and readable — inspect the scripts yourself or run them in a sandboxed environment first. If you accept the risks, run with an account you can afford to expose and remove stored cookies after use. If you want, I can point out the exact lines to change to re-enable SSL verification and to harmonize the default cookie path.