Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
post-to-xhs
v1.0.1小红书内容发布与管理助手。当用户要求登录、发小红书、搜索小红书、评论点赞收藏等任何小红书相关操作时使用。
⭐ 1· 469·0 current·0 all-time
byWeizheng Lu@luweizheng
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The name/description (posting and managing Xiaohongshu content) match the instructions: installing a Python CLI (xhs-mcp-py), using Playwright/Chromium for browser-based login/automation, and providing commands for publish/search/like/comment. The required binary 'convert' (ImageMagick) is plausible for image processing.
Instruction Scope
SKILL.md stays focused on Xiaohongshu workflows (login, publish, search, interact). It instructs installing/playwright and running xhs-mcp commands that read image/video files supplied by the user and persist cookies locally. Note: the tool prints/returns tokens (xsec_token) and stores cookies (7–30 days), which are necessary for the described actions but are sensitive local artifacts.
Install Mechanism
The skill itself has no install spec, but the instructions require installing a third‑party Python package (pip install xhs-mcp-py) and Playwright browsers. These are reasonable for a CLI that automates a web UI, but they mean arbitrary code will be downloaded and executed from PyPI and Playwright's distribution — users should vet that package/source before installing.
Credentials
The skill declares no environment variables or credential requirements. The runtime behavior relies on interactive login (QR code, browser) and local cookie storage; sensitive data (cookies, xsec_token) are produced by normal operations and are proportionate to the skill's purpose.
Persistence & Privilege
always is false and the skill is user-invocable. The documented persistence is limited to the tool's local cookie files (login lifetime ~7–30 days). The skill does not request elevated system-wide privileges or modification of other skills' configs.
Assessment
This skill is coherent for automating Xiaohongshu actions, but it delegates work to a third‑party Python package (xhs-mcp-py) and Playwright/Chromium which you must install. Before installing/running: 1) review the xhs-mcp-py package source (PyPI project, repo) to ensure you trust it; 2) run it in an isolated environment (VM/container) if you are unsure; 3) be aware the tool will save login cookies and print tokens (xsec_token) — treat those as sensitive credentials; 4) do not run this on systems holding other secrets or high privileges without review; 5) install zbar/ImageMagick only if needed and from official OS packages. If you want a higher assurance, ask the skill author for a code repository link or a signed release before installing.Like a lobster shell, security has layers — review code before you run it.
latestvk97aceq5zb3zg3qcg5pxmh6jws81x4qz
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
📕 Clawdis
Binsconvert