Xiaohongshu Search Summarizer
Analysis
The skill mostly does what it claims, but it runs local browser automation and has an unsafe filename construction that can write outside the requested output folder if the search keyword contains path characters.
Findings (5)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
md_filename = f"{keyword.replace(' ', '_')}_raw_data.md"
md_path = os.path.join(output_dir, md_filename)
...
with open(md_path, 'w', encoding='utf-8') as f:The keyword is used as part of a filesystem path without rejecting '/', absolute paths, or '..'. A crafted or accidental keyword can cause the Markdown output to be written outside the intended output directory.
playwright-cli run-code "$(< "$SCRIPT_PATH")" > "$OUTPUT_DIR/xhs_data.json" python3 "$(dirname "$0")/parse.py" "$KEYWORD" "$OUTPUT_DIR/xhs_data.json" "$OUTPUT_DIR"
The skill executes generated Playwright JavaScript and a Python parser locally. This is central to the stated browser-scraping purpose, but it is still local code execution that users should knowingly approve.
compatibility: Requires playwright-cli and python3, and the Python 'requests' package installed.
The skill depends on local external tools and a Python package, while the registry metadata lists no required binaries or install spec. The dependency need is disclosed in SKILL.md, but not fully captured by metadata.
Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.
Xiaohongshu may demand a login challenge. If the site pauses waiting for a login, instruct the user to verify the `playwright-cli` browser window and perform necessary authentication manually
The skill may operate in an authenticated Xiaohongshu browser session if the user logs in manually. The artifacts do not show credential theft, but authenticated access expands what the scraper may see.
Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.
extracts the top N posts (including texts, images, and user comments) ... You MUST use your file reading / vision capabilities on these image file paths
The skill intentionally brings untrusted social-media text, comments, and images into the agent's context for synthesis. This is expected for summarization, but such content can contain prompt-injection-like instructions.