Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
小红书自动发布助手
v1.0.0Draft and publish posts to 小红书 (Xiaohongshu/RED). Use when creating content for 小红书, drafting posts, generating cover images, or publishing via browser automation. Covers the full workflow from content creation to browser-based publishing, including cover image generation with Pillow.
⭐ 3· 4k·36 current·39 all-time
by@yuf1011
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description match the actual behavior: drafting content, generating a cover image (Pillow script included), and automating a browser publish via the OpenClaw browser tool. No unrelated credentials, binaries, or hidden network endpoints are requested.
Instruction Scope
SKILL.md stays within publishing scope (draft → cover → review → publish). It instructs writing a draft file (memory/xiaohongshu-draft.md), generating/saving cover images to disk, sending posts to the user's messaging channel, and controlling a logged-in browser for publishing. These actions are expected for a publisher skill, but they mean the agent will act through the user's logged-in browser session (powerful capability) and will write files to disk (cover image, draft). The doc emphasizes 'Never auto-publish,' which mitigates risk if followed.
Install Mechanism
No install spec is provided (instruction-only skill). The included Python script uses Pillow and system fonts, which is proportional for cover generation. The script searches local font paths rather than downloading anything from the network; no external downloads or extraction steps are present.
Credentials
The skill requests no environment variables or credentials. It requires access to an OpenClaw browser node and the user's logged-in browser session — appropriate for performing browser-based publishing but a capability the user should limit to trusted nodes/profiles.
Persistence & Privilege
The skill does not set always:true, and model invocation is allowed (platform default). The SKILL.md documents cron integration for scheduled drafting/announcements; while the skill itself does not auto-publish, scheduled runs could produce drafts and send review messages automatically. Users should confirm scheduling and approval workflows to avoid unintended autonomous publishing.
Assessment
This skill is coherent for creating Xiaohongshu posts: it generates cover images locally (Pillow) and automates a browser that must be logged into the user's creator account. Before installing, ensure the OpenClaw node/browser profiles you give it access to are trusted (the agent will act using that logged-in session). Confirm your messaging channel and cron settings so drafts are reviewed before publishing—the skill emphasizes manual approval, but scheduled runs could still draft and announce content. You can inspect scripts/gen_cover.py locally (it only draws images and searches local font paths). If you do not want the agent to control a logged-in browser at all, do not grant it access to browser nodes or disable autonomous invocation/scheduling for this skill.Like a lobster shell, security has layers — review code before you run it.
automationvk97e0trf1cnf8vcy2q7dr270v1810n9ylatestvk97e0trf1cnf8vcy2q7dr270v1810n9yredbookvk97e0trf1cnf8vcy2q7dr270v1810n9ysocial-mediavk97e0trf1cnf8vcy2q7dr270v1810n9yxiaohongshuvk97e0trf1cnf8vcy2q7dr270v1810n9y
License
MIT-0
Free to use, modify, and redistribute. No attribution required.