Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

小红书自动发布工具包 (Xiaohongshu Publish Kit)

v1.2.0

Complete toolkit for publishing content to Xiaohongshu (小红书). Includes automated browser control, image generation, content formatting, and full publishing p...

0· 208·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for siaslfs/xiaohongshu-publish-kit.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "小红书自动发布工具包 (Xiaohongshu Publish Kit)" (siaslfs/xiaohongshu-publish-kit) from ClawHub.
Skill page: https://clawhub.ai/siaslfs/xiaohongshu-publish-kit
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required binaries: python3
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install xiaohongshu-publish-kit

ClawHub CLI

Package manager switcher

npx clawhub@latest install xiaohongshu-publish-kit
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The declared purpose (Xiaohongshu publishing) matches the scripts provided: browser automation, cover generation, content formatting and publishing. However the package relies heavily on an OpenClaw/browser CLI (scripts call 'browser' or 'openclaw browser' extensively), yet the registry metadata only lists python3 as a required binary and declares no required config paths. That mismatch (implicit requirement for openclaw/browser and access to browser profiles) is unexpected and should have been declared.
!
Instruction Scope
Runtime instructions and scripts perform browser automation as described, but they also read and write browser user-data (Path.home()/'.openclaw/browser/openclaw/user-data'), create backups in /tmp, and offer automated restore. Those operations access sensitive session data (cookies, tokens) which is coherent with keeping login persistent but is sensitive and not declared. Several subprocess.run calls use shell=True with commands constructed from string interpolation (e.g., cover generation and example runner), which introduces command-injection risk if untrusted inputs are passed. The SKILL.md and scripts also advise adding crontab or running a daemon for periodic keepalive — that gives the code long-lived execution on the host if the user enables it.
Install Mechanism
This is instruction- and script-based (no install spec). That is the lowest install risk category. No remote download URLs or package installers are supplied by the skill itself.
!
Credentials
The skill declares no required env vars or config paths, but the scripts implicitly access and modify user configuration and data paths (e.g., ~/.openclaw/browser/openclaw/user-data, /tmp/xiaohongshu_session_backup). Copying and restoring that directory gives access to browser session cookies and other sensitive data. The lack of explicit declaration of those config path requirements is an inconsistency. No external API keys are requested.
Persistence & Privilege
The skill itself is not forced always: true and does not autonomously enable persistence. However the included setup script offers to add a crontab entry or run a daemon (login_keeper) which, if the user consents, will give persistent, periodic execution and repeated access to the user's browser profile. This persistent behavior is user-driven (not automatic) but is powerful and should be enabled only after review.
What to consider before installing
What to consider before installing or enabling this skill: - Verify OpenClaw/browser availability: The code expects a browser CLI (openclaw / browser) though the registry only lists python3. Do not install or run until you confirm you have a trusted OpenClaw/browser binary and understand what it controls. - Session data is accessed and backed up: login_keeper.py and publish.py copy your browser user-data (~/.openclaw/browser/openclaw/user-data) to /tmp/xiaohongshu_session_backup and can restore it. That directory contains cookies and authentication data; treat it as sensitive. If you enable backups, secure or delete backups when not needed. - Persistent operation is optional but powerful: setup_keepalive.sh can add a crontab or run a daemon that periodically drives your browser and backups. Only enable this if you trust the code and accept long-lived automation operating on your account. - Command injection / shell usage: The scripts run subprocesses with shell=True and interpolate strings into shell commands (e.g., cover generation and example runner). If you ever pass untrusted input into titles, content, file paths, or other arguments, it could be abused. Consider hardening code (avoid shell=True, use list args) or sanitize inputs before use. - Review and test locally / sandboxed: Inspect scripts (especially login_keeper.py, publish.py, cover_generator.py, setup_keepalive.sh). Run them in an isolated environment or VM with a throwaway browser profile to confirm behavior before using them with your real account. - Least privilege and file permissions: Do not run as root. Restrict access to /tmp backups (chmod) if you enable backups. Manually inspect and remove any backup files after testing. - Notifications and extensions: The code has placeholder hooks for sending notifications to external services; do not wire any remote endpoints (Telegram, email, webhooks) until you audit any code you add. If you want, I can point out the exact lines/functions that perform session copying, subprocess shell execution, and crontab modification so you can review them more quickly.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

📕 Clawdis
Binspython3
latestvk975777gwfxht553pkq7bzs4zd832bxg
208downloads
0stars
3versions
Updated 52m ago
v1.2.0
MIT-0

小红书自动发布工具包 (Xiaohongshu Publish Kit)

通过 OpenClaw 托管浏览器实现小红书图文笔记的完全自动化发布。支持AI内容生成、封面制作、格式化和一键发布。

功能特性

完整自动化流程

  • 自动登录检测和页面导航
  • 智能图片上传(支持多张图片)
  • 标题和正文自动填写
  • 发布状态验证

🎨 内容创作支持

  • 自动生成科技风封面图片
  • AI内容格式化(适配小红书规范)
  • 话题标签自动插入
  • 字数限制自动检查

🔧 开发者友好

  • 完整的Python脚本示例
  • 详细的浏览器控制命令
  • 错误处理和重试机制
  • 可扩展的模块化设计

平台限制(严格遵守)

⚠️ 小红书平台规则

  • 标题:最多 20 个字符(超出导致发布失败)
  • 正文:最多 1000 个字符
  • 图片:1-18张,最大32MB,推荐png/jpg/jpeg/webp
  • 尺寸:推荐3:4至2:1,分辨率≥720x960

快速开始

1. 环境准备

# 启动托管浏览器
browser --browser-profile openclaw start

# 创建图片上传目录
mkdir -p /tmp/openclaw/uploads

2. 登录小红书创作平台

首次使用需要手动登录一次:

browser --browser-profile openclaw navigate https://creator.xiaohongshu.com

手动扫码登录后,可设置自动保活:

# 设置登录保活(推荐)
./scripts/setup_keepalive.sh

3. 登录保活设置(重要)

为避免频繁扫码,强烈建议设置自动保活:

方法1: Crontab 定时保活(推荐)

./scripts/setup_keepalive.sh
# 选择选项1,每30分钟自动检查登录状态

方法2: 手动检查

python3 scripts/login_keeper.py --mode check

方法3: 守护进程

python3 scripts/login_keeper.py --mode daemon --interval 30

3. 使用脚本发布

python3 ~/.openclaw/workspace/skills/xiaohongshu-publish-kit/scripts/publish.py \
  --title "你的标题(≤20字)" \
  --content "你的正文内容(≤1000字)" \
  --image "/path/to/your/cover.jpg"

或者使用AI辅助发布:

python3 ~/.openclaw/workspace/skills/xiaohongshu-publish-kit/scripts/ai_publish.py \
  --topic "AI技术发展" \
  --generate-cover

详细使用说明

浏览器控制流程

小红书发布涉及多个步骤的浏览器操作,每步都有特定的技术要求:

Step 1: 页面导航

browser --browser-profile openclaw navigate https://creator.xiaohongshu.com/publish/publish
browser --browser-profile openclaw wait 3000

Step 2: 切换到图文模式

⚠️ 重要:必须使用JS方式点击,直接click会触发文件选择器

browser --browser-profile openclaw evaluate --fn "() => {
  const tabs = document.querySelectorAll('.creator-tab, [class*=tab]');
  for (const t of tabs) {
    if (t.textContent.trim().includes('上传图文')) {
      t.click();
      return 'switched to image-text mode';
    }
  }
  return 'tab not found';
}"

Step 3: 上传图片

# 先arm文件,再点击按钮
browser --browser-profile openclaw upload /tmp/openclaw/uploads/cover.jpg
browser --browser-profile openclaw snapshot  # 找到上传按钮的ref
browser --browser-profile openclaw click <upload_button_ref>
browser --browser-profile openclaw wait 5000  # 等待上传完成

Step 4: 填写标题

标题是<input>元素,需要使用原生setValue方式:

browser --browser-profile openclaw evaluate --fn "() => {
  const el = document.querySelector('input[placeholder*=\"标题\"]');
  if (!el) return 'title input not found';
  const setter = Object.getOwnPropertyDescriptor(window.HTMLInputElement.prototype, 'value').set;
  setter.call(el, '你的标题内容');
  el.dispatchEvent(new Event('input', {bubbles:true}));
  el.dispatchEvent(new Event('change', {bubbles:true}));
  return 'title set, length=' + el.value.length;
}"

Step 5: 填写正文

正文是contenteditable富文本编辑器,使用innerHTML:

browser --browser-profile openclaw evaluate --fn "() => {
  const el = document.querySelector('.ql-editor, [contenteditable=true], .ProseMirror');
  if (!el) return 'editor not found';
  el.focus();
  el.innerHTML = '<p>第一段</p><p><br></p><p>第二段</p><p><br></p><p>#话题标签</p>';
  el.dispatchEvent(new Event('input', {bubbles:true}));
  return 'body set, length=' + el.textContent.length;
}"

Step 6: 发布验证

# 检查字数是否合规
browser --browser-profile openclaw evaluate --fn "() => {
  const titleEl = document.querySelector('input[placeholder*=\"标题\"]');
  return 'title length=' + (titleEl ? titleEl.value.length : 0);
}"

# 点击发布
browser --browser-profile openclaw evaluate --fn "() => {
  const btns = document.querySelectorAll('button');
  for (const b of btns) {
    if (b.textContent.trim() === '发布') {
      b.click();
      return 'publish clicked';
    }
  }
  return 'publish button not found';
}"

# 验证发布成功(URL包含published=true)
browser --browser-profile openclaw tabs

高级功能

自动封面生成

使用内置的封面生成功能:

from scripts.cover_generator import generate_tech_cover

# 生成蓝紫科技风封面
cover_path = generate_tech_cover(
    title="AI热点速递",
    date="2026.03.17",
    style="tech_blue"
)

内容格式化

from scripts.content_formatter import format_for_xiaohongshu

# 自动格式化内容
formatted = format_for_xiaohongshu(
    title="原始标题可能很长需要截断",
    content="原始内容...",
    tags=["AI", "科技", "热点"]
)

批量发布

from scripts.batch_publisher import BatchPublisher

publisher = BatchPublisher()
publisher.add_post(title="标题1", content="内容1", image="图片1")
publisher.add_post(title="标题2", content="内容2", image="图片2")
publisher.publish_all()

常见问题

Q: 发布按钮点击无反应?

A: 检查标题是否超过20字,或正文是否为空。小红书会禁用不合规的发布。

Q: 图片上传失败?

A: 确认图片格式(png/jpg/jpeg/webp)和大小(<32MB),避免使用gif。

Q: 登录状态丢失?

A: 重新在托管浏览器中扫码登录一次即可。

Q: 页面加载缓慢?

A: 增加等待时间,或检查网络连接。

扩展开发

添加新的封面样式

scripts/cover_generator.py中添加新的样式模板:

def generate_custom_cover(title, **kwargs):
    # 你的自定义封面逻辑
    pass

集成其他内容源

实现ContentProvider接口:

class MyContentProvider(ContentProvider):
    def fetch_content(self):
        # 返回格式化的内容
        pass

许可证

MIT License - 可自由使用、修改和分发。


注意:本工具仅供学习和合法使用,请遵守小红书平台规则和相关法律法规。

Comments

Loading comments...