redbook

• Analyzed: May 16, 2026, 5:12 AM
• Findings: 1
• Version: 0.7.2
• Hash: 53b4fb325070e25f8f8ecd5912abb67a489fdfb4ead21867bc92518829f3f751
• Source: palm
• External report: View on VirusTotal

Findings (1)

The redbook skill bundle is a legitimate CLI tool for Xiaohongshu (XHS) automation and analysis. It extracts browser cookies locally (via sweet-cookie and a CDP fallback in src/lib/cdp-cookies.ts) to authenticate with XHS APIs, which is consistent with its stated purpose. The post-install script (scripts/postinstall.js) performs targeted patches on its dependencies to fix specific bugs related to macOS keychain timeouts and BigInt handling, which is a functional requirement rather than a malicious act. The SKILL.md provides detailed operational instructions for AI agents, including safety guidelines such as rate limits, jitter, and dry-run requirements to prevent account bans. No evidence of data exfiltration, unauthorized remote control, or malicious prompt injection was found.