sexy-claw

🦞 色😍龙虾 - 根据主人审美偏好，在多个平台（小红书、抖音、YouTube、B站）搜索并推荐颜值博主/视频。 自动获取用户cookies，学习主人喜好，推送个性化内容。 使用场景： - 主人说"找美女/小姐姐/颜值博主" - 主人提到特定平台（小红书/抖音/YouTube/B站） - 主人给出审美偏好（如"...

Security Scan

The skill mostly does what it says (searches multiple video platforms), but it asks you to collect and store sensitive session cookies, relies on undeclared external tools (yt-dlp, xhs CLI, Python requests), and contains a few implementation mismatches that you should review before using.

Purpose & Capability

The name/description (search and recommend creators across 小红书/抖音/B站/YouTube) matches the code: scripts query each platform. However the skill metadata declares no required binaries or environment variables while the code expects external CLIs (xhs, yt-dlp) and Python networking (requests). Also xhs_search.py activates a hard-coded virtualenv path (~/.agent-reach-venv) which is not documented—this is an unexplained dependency/mismatch.

Instruction Scope

SKILL.md instructs the user to extract and save platform cookies and the scripts read those cookies from references/platform_cookies.json. The description claims '自动获取用户cookies' but the runtime instructions require the user to manually copy cookies (no automated browser integration). The skill instructs opening video links locally (open), and scripts access the user's home path to source a virtualenv. These behaviors are within the stated purpose but involve handling sensitive session tokens and an undocumented venv path.

Install Mechanism

There is no install spec (instruction-only), so nothing is written by an installer. That reduces some risk. However the scripts depend on external tools (yt-dlp, xhs CLI) and Python packages (requests) that are not declared — the skill will fail or behave unexpectedly unless the environment already has these tools. No downloads or remote install URLs are present.

Credentials

No environment variables or cloud credentials are requested, which is appropriate. But the skill explicitly asks for and stores authentication cookies (web_session/a1, sessionid/ttwid, SESSDATA/bili_jct). Those are high-sensitivity secrets that effectively grant session access to user accounts; storing them in a plaintext local JSON file is proportionate to the task but risky and should be made explicit to the user. The skill claims cookies are stored locally and not uploaded (and the code shows no exfiltration), but that guarantee is purely declarative and should be verified by users.

Persistence & Privilege

The skill does local persistence only (references/user_preference.json and references/platform_cookies.json). It is not 'always: true' and does not modify other skills or system-wide config. Local persistence is expected for user preferences and cookie storage, but it increases privacy risk due to stored session tokens.

What to consider before installing

This skill appears to implement the advertised search across platforms, but you should take precautions before installing or using it: - Cookies are sensitive: the skill asks you to copy platform session cookies and saves them as plaintext JSON in the skill directory. Those tokens can grant account access. Only use throwaway accounts or be prepared to revoke/change cookies if compromised. - Undeclared dependencies: the scripts call 'yt-dlp' and an 'xhs' CLI and use Python requests; they also attempt to source ~/.agent-reach-venv. Ensure you understand and audit those third-party tools (especially the xhs CLI) before running them. Install them from trusted sources. - Verify behavior: inspect the xhs and yt-dlp commands and confirm the skill does not transmit cookies or preferences to any external endpoint. The packaged code shows no upload endpoints, but verify after any changes. - Prefer ephemeral use: if possible, avoid long-term storage of live session cookies; use limited or logged-out searches or ephemeral browser profiles. - If you lack technical skills: consider not installing or only run the scripts in an isolated environment (VM/container) and review/replace any hard-coded paths (e.g., the ~/.agent-reach-venv activation) before use. Given these privacy and dependency mismatches, proceed only if you are comfortable managing session tokens and can verify the third-party tools the scripts invoke.

🦞 Sexy-Claw 色😍龙虾

根据主人审美品味，在多个社交平台搜索并推荐颜值博主/视频。

"让每一次搜索都充满惊喜 😍"

工作流程

1. 获取主人审美偏好

首次使用时，询问主人：

• 喜欢什么类型？（甜美/御姐/清纯/性感/可爱...）
• 有喜欢的博主吗？（habin/leeesovely/真栗/兔娘...）
• 偏好哪个平台？（小红书/抖音/YouTube/B站）

将偏好保存到 references/user_preference.json

2. 获取平台 Cookies

如果主人未提供 cookies，引导主人获取：

小红书：

1. 登录 https://www.xiaohongshu.com
2. F12 → Application → Cookies
3. 复制 web_session, a1 等关键字段

抖音：

1. 登录 https://www.douyin.com
2. F12 → Application → Cookies
3. 复制 sessionid, ttwid 等关键字段

B站：

1. 登录 https://www.bilibili.com
2. F12 → Application → Cookies
3. 复制 SESSDATA, bili_jct 等关键字段

YouTube：

• 通常不需要 cookies，直接搜索即可

将 cookies 保存到 references/platform_cookies.json

3. 搜索推荐

根据主人偏好，在对应平台搜索：

# 小红书
python3 scripts/xhs_search.py "关键词" 10

# 抖音
python3 scripts/douyin_search.py "关键词" 10

# B站
python3 scripts/bilibili_search.py "关键词" 10

# YouTube
yt-dlp --dump-json "ytsearch5:关键词"

4. 打开视频

将搜索结果按播放量/点赞排序，打开前3-5个最热门的视频：

open "视频链接"

平台支持

平台	状态	需要的 Cookies
小红书	✅	web_session, a1
抖音	✅	sessionid, ttwid
B站	✅	SESSDATA, bili_jct
YouTube	✅	无需

脚本使用

搜索小红书

python3 scripts/xhs_search.py "颜值 美女" 10

搜索抖音

python3 scripts/douyin_search.py "美女" 10

搜索B站

python3 scripts/bilibili_search.py "真栗" 10

获取用户视频

python3 scripts/bilibili_search.py user 129641517 5

主人偏好记录

保存在 references/user_preference.json：

{
  "preferred_type": ["御姐", "甜美"],
  "favorite_creators": ["habin", "leeesovely", "真栗"],
  "preferred_platforms": ["抖音", "B站"],
  "last_search": "2024-01-01",
  "search_history": []
}

Cookies 记录

保存在 references/platform_cookies.json：

{
  "xiaohongshu": {
    "web_session": "xxx",
    "a1": "xxx"
  },
  "douyin": {
    "sessionid": "xxx",
    "ttwid": "xxx"
  },
  "bilibili": {
    "SESSDATA": "xxx",
    "bili_jct": "xxx"
  }
}

注意事项

1. 隐私保护：cookies 只保存在本地，不上传
2. 定期更新：cookies 会过期，需要定期重新获取
3. 频率控制：避免频繁搜索，防止触发平台风控
4. 主人确认：首次使用需主人明确同意保存偏好和cookies

---

🦞 色龙虾，让美好触手可及 😍