ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

小红书智能回复助手

v1.0.0

小红书智能回复助手 - 自动分析评论情感和意图，生成个性化回复建议。 Use for: (1) Analyzing Xiaohongshu comment sentiment and intent, (2) Generating personalized reply suggestions, (3) Managi...

⭐ 2· 696·2 current·3 all-time
by@xiaoliuzhuan
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
medium confidence
✓
Purpose & Capability
Name/description match the instructions: the SKILL.md describes sentiment/intent analysis, reply generation, batch processing and optional Xiaohongshu API integration. The use of session cookies/xsec tokens for API access is consistent with integrating with the platform. Minor mismatch: the SKILL.md references local scripts and an install.sh, but the published package is instruction-only (no code files included).
ℹ
Instruction Scope
Instructions are focused on the stated task. They reference reading/writing a config and history in ~/.xhs_reply_assistant/ (expected) and show how to pass a web_session cookie and xsec_token to the API integration (expected for real-account integration). The SKILL.md also suggests running an install.sh and uses example scripts/modules that are not present in the package — that leaves unspecified behavior if you follow those steps.
ℹ
Install Mechanism
There is no formal install spec in the registry, but SKILL.md suggests 'pip3 install aiohttp loguru pycryptodome getuseragent' and running an install.sh. Pip installs are standard and the listed packages are plausible; however, install.sh is referenced but not included in the published files — running an unknown install.sh would be risky.
✓
Credentials
The registry declares no required environment variables or credentials. The SKILL.md demonstrates optional use of a session cookie and xsec_token when connecting to Xiaohongshu, which is proportional to the optional API integration. No unrelated credentials or secret-sounding env vars are requested.
✓
Persistence & Privilege
Skill is not always-enabled and does not request elevated system presence. It stores config/history under the user's home directory, which is appropriate for this functionality. There is no indication it modifies other skills or global agent settings.
Assessment
This skill appears to do what it says, but note: (1) it's instruction-only here — there is no packaged code to review even though the README references scripts and install.sh; (2) only provide session cookies/xsec_token if you trust the code you will run — these are account credentials; (3) do not run an unknown install.sh without inspecting it first; (4) if you plan to integrate with a real Xiaohongshu account, prefer a least-privilege or secondary/testing account and rotate tokens after use; (5) ask the publisher for the full source code or a verified release (or run the offline quick_analyze mode that doesn't require secrets) so you can audit what will actually run before installing/executing anything.

Like a lobster shell, security has layers — review code before you run it.

commentsvk97f4wqh372ew6hrqnvtsjztw1824m8vlatestvk97f4wqh372ew6hrqnvtsjztw1824m8vnlpvk97f4wqh372ew6hrqnvtsjztw1824m8vrednotevk97f4wqh372ew6hrqnvtsjztw1824m8vsocial-mediavk97f4wqh372ew6hrqnvtsjztw1824m8vxiaohongshuvk97f4wqh372ew6hrqnvtsjztw1824m8v

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments