Security checks across malware telemetry and agentic risk
This skill is not clearly malicious, but it needs review because it can control a logged-in Xiaohongshu account, post/comment publicly, and read/export account data beyond its short description.
Install only if you intend to let an agent operate a Chrome session logged into Xiaohongshu. Use a dedicated browser profile/account, avoid remote CDP unless the endpoint is private and trusted, do not use --auto-publish casually, and manually review each post, comment, notification read, analytics export, account switch, or profile deletion.
for line in result.stdout.splitlines():
if f":{port}" in line and "LISTENING" in line:
pid = line.strip().split()[-1]
subprocess.run(
["taskkill", "/F", "/PID", pid],
capture_output=True, timeout=5
)requests>=2.28.0 websockets>=12.0
requests>=2.28.0 websockets>=12.0
64/64 vendors flagged this skill as clean.