Security checks across malware telemetry and agentic risk
The skill mostly matches its Xiaohongshu automation purpose, but it bundles sensitive session handling and network-exposed automation features that need review before installation.
Install only if you are comfortable giving the skill access to your Xiaohongshu session and letting it publish on your behalf. Keep the MCP server disabled or bound to localhost unless you deliberately secure it, protect ~/.openclaw/credentials/xhs_cookies.json and backups as live login credentials, and use preview or dry-run modes before any publishing workflow.
def run_command(cmd, check=True):
"""运行命令并返回结果"""
try:
result = subprocess.run(cmd, shell=True, capture_output=True, text=True, check=check)
return result.returncode == 0, result.stdout, result.stderr
except Exception as e:
return False, "", str(e)try:
if os.name == 'nt': # Windows
# 使用 where 命令检查
result = subprocess.run(f"where {cmd}", shell=True, capture_output=True)
if result.returncode == 0:
return True
else:return True
else:
# Unix 系统使用 which
result = subprocess.run(f"which {cmd}", shell=True, capture_output=True)
if result.returncode == 0:
return True
except:safe_print("🧹 清理ChromeDriver进程...")
try:
if os.name == 'nt':
subprocess.run(["taskkill", "/F", "/IM", "chromedriver.exe"],
capture_output=True)
else:
subprocess.run(["pkill", "-f", "chromedriver"],subprocess.run(["taskkill", "/F", "/IM", "chromedriver.exe"],
capture_output=True)
else:
subprocess.run(["pkill", "-f", "chromedriver"],
capture_output=True)
except:
passsafe_print(f"🔍 找到MCP服务器进程: {pid}")
try:
if os.name == 'nt': # Windows
subprocess.run(["taskkill", "/F", "/PID", pid], check=True)
else: # Unix-like
os.kill(int(pid), signal.SIGTERM)
time.sleep(2)if cm_cookies_path.resolve() != target_path.resolve() and cm_cookies_path.exists():
target_path.parent.mkdir(parents=True, exist_ok=True)
import shutil
shutil.copy2(cm_cookies_path, target_path)
print(json.dumps({
"status": "success",cmd = ["uv", "run", "--project", toolkit_dir, str(script_path)] + args
result = subprocess.run(
cmd,
capture_output=True,
text=True,64/64 vendors flagged this skill as clean.