Xiaohongshu Auto Publisher
v0.0.1Posts content (images/videos) to Xiaohongshu (Little Red Book) automatically using Playwright. Use this skill when you need to publish content to Xiaohongshu.
⭐ 0· 87·0 current·0 all-time
byYi Xu@widebluesky
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description match the included artifacts: both scripts use Playwright to log in and publish to Xiaohongshu. No unrelated binaries or credentials are requested.
Instruction Scope
Instructions are narrowly scoped to interactive login and posting. They instruct saving/loading a storage_state (state.json) in the skill directory — this contains authentication cookies/tokens and is sensitive. No evidence the scripts read other system files or exfiltrate data to third‑party endpoints.
Install Mechanism
No install spec in the registry; SKILL.md tells the user to pip install Playwright and run playwright install chromium (standard). The docs mention 'requests' though the shipped scripts do not use it — minor inconsistency but not malicious.
Credentials
The skill requires no environment variables or external credentials, which is proportionate. However, it stores the authenticated browser state (cookies/tokens) in state.json under the skill folder; that file grants access to the logged-in Xiaohongshu account and should be protected or stored in a secure location.
Persistence & Privilege
always:false and no system-wide changes. The skill writes only its own state.json in its directory (normal for Playwright session persistence) and does not modify other skills or global agent configuration.
Assessment
This skill appears to do what it says: automate an interactive login (via your browser) and then publish using the saved Playwright storage state. Before installing or running it: (1) review the two Python scripts yourself (they are short and readable); (2) be aware state.json will contain session cookies/tokens — store it securely, or remove it when you no longer need automated publishing; (3) prefer running the initial login and publishing in an isolated environment or with a dedicated Xiaohongshu account if you’re concerned about credential exposure; (4) install Playwright via the documented steps (pip install playwright && playwright install chromium); and (5) note SKILL.md references the 'requests' package though the code does not use it (harmless, but a minor documentation mismatch). If you need stronger assurance, run the scripts in a disposable VM or container so the saved state and browser artifacts remain isolated.Like a lobster shell, security has layers — review code before you run it.
latestvk975804fzx0hsjexk07nxwwm1983qvjb
License
MIT-0
Free to use, modify, and redistribute. No attribution required.