Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
小红书自动化 V2
v2.0.0基于Chrome DevTools Protocol，实现小红书认证登录、内容发布、搜索发现和社交互动的完整自动化操作。
⭐ 0· 296·1 current·1 all-time
byNANA@tinadu-ai
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description align with the code: the package implements Chrome CDP automation for login, publishing, search, and interactions. The code manipulates Chrome, manages profiles under ~/.xhs, downloads images, and implements publish pipelines — all coherent with the stated purpose. However, some runtime environment variables (CHROME_BIN, XHS_PROXY) and local paths are relied on even though the skill metadata declares no required env/configs.
Instruction Scope
SKILL.md and CLI instruct running local Python commands that will: launch/kill Chrome, control pages via CDP, persist cookies and profiles under ~/.xhs, download remote images, and run lsof/netstat/taskkill to find/kill processes. Those actions are within the functional scope but the README contains detected unicode-control-chars (prompt-injection style) which is unexpected and suspicious. The instructions do not declare required env vars the code will read, leaving a mismatch between advertised and actual runtime behavior.
Install Mechanism
No install spec; code is bundled with the skill and runs as Python scripts. No external archive downloads or package installers are used by the skill package itself, which reduces supply-chain risk. It does import third-party libraries (requests, websockets) that would need to be present or installed via a requirements.txt referenced by SKILL.md.
Credentials
Skill metadata lists no required environment variables, but the code reads CHROME_BIN, XHS_PROXY and implicitly depends on a writable home directory (~/.xhs). It also interacts with the network to download images and uses system utilities (lsof/netstat/taskkill). Requesting/using CHROME_BIN and XHS_PROXY are reasonable for a browser automation tool, but the omission from metadata is a mismatch and increases the chance users won't notice these behaviors.
Persistence & Privilege
The skill does not request always:true and does not modify other skills. It persists data and profiles under ~/.xhs and can create/modify cookies and image caches there. It also intentionally adds Chrome flags (--no-sandbox, --disable-setuid-sandbox) to support running as root; this is functional for some environments but weakens process isolation and increases risk if the machine or containers host sensitive data.
Scan Findings in Context
[unicode-control-chars] unexpected: The SKILL.md contained unicode control characters (prompt-injection patterns). This is not expected for a simple README and could indicate an attempt to hide or manipulate textual content; review SKILL.md/raw source for invisible characters before trusting documentation or running automated installs.
What to consider before installing
What to consider before installing/running this skill:
- The code largely matches the described automation capability (it controls Chrome via CDP, manages profiles under ~/.xhs, and implements publishing/search/commenting flows), but the README includes hidden unicode control characters — inspect SKILL.md with a hex viewer or a trusted editor to ensure no hidden instructions are present.
- The package will write persistent data to your home directory (~/.xhs): saved profiles, cookies, images, and a run.lock. If you plan to test, do so in an isolated account or container and back up any data you care about.
- The code reads environment variables (CHROME_BIN to locate Chrome, XHS_PROXY for proxying) even though the skill metadata lists none. Be aware of these runtime knobs and set them intentionally; an attacker could try to direct traffic via a proxy if you unknowingly export one.
- It launches Chrome with --no-sandbox/--disable-setuid-sandbox to support root execution; running Chrome without sandboxing is less secure. Avoid running this on production hosts or on machines with sensitive data — prefer an isolated VM or disposable container.
- The skill can run system utilities to find/kill processes and will spawn subprocesses (Chrome). That behavior is necessary for this automation but consider limits: it can terminate processes bound to the CDP port if they conflict.
- Network activity: the tool will fetch images from arbitrary URLs and talk to Chrome's local debugging endpoint. Review any URLs you pass to it and monitor outbound connections if you run it.
- Recommended actions before use: review the full source (especially any truncated/omitted files), remove or neutralize hidden control characters in SKILL.md, run in an isolated environment, and inspect or pin third-party dependencies from requirements.txt. If you plan to use real accounts, consider risks related to platform ToS and detection avoidance code (anti-detection/stealth) that may be ethically or legally problematic.Like a lobster shell, security has layers — review code before you run it.
latestvk979rfvj1jc2j95wkrym1p5qzs82c011
License
MIT-0
Free to use, modify, and redistribute. No attribution required.