redbook skill1.0
v1.0.0定时采集近24小时小红书低粉爆款果茶咖啡健康饮品热点，生成手机友好HTML报告并自动推送飞书群。
⭐ 1· 179·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (采集小红书近24小时低粉爆款并推送飞书) aligns with the runtime instructions: it uses ArkClaw connectors (小红书内容搜索 + 飞书机器人) to collect, analyze, render HTML, and post to Feishu. The required capability (a Feishu webhook to post results) is appropriate for the stated function. Note: registry metadata at the top of the package lists no required env vars while SKILL.md declares FEISHU_WEBHOOK — this mismatch should be resolved.
Instruction Scope
SKILL.md gives explicit, narrow runtime steps: enable Volcengine/ArkClaw connectors, configure webhook and cron, collect 24h data via the official connector, filter/AI-analyze results, render HTML, and POST to Feishu. Instructions do not ask to read unrelated local files or other environment variables, nor to exfiltrate arbitrary data. Mentions of adding ArkClaw IP to Feishu whitelist are operational, not suspicious.
Install Mechanism
Instruction-only skill with no install spec and no code files to write or execute on the host. This minimizes disk/network install risk. The README/SKILL.md point to using ArkClaw visual console and official connectors rather than downloading arbitrary binaries.
Credentials
SKILL.md requires a single sensitive value: FEISHU_WEBHOOK (a posting webhook URL). That is proportionate because the skill must send messages to Feishu. However, the package-level metadata provided earlier contradicted SKILL.md by listing no required env vars — confirm FEISHU_WEBHOOK will be requested at install time. Also note: webhook URLs are effectively secrets — anyone with them can post to the group, so use a dedicated webhook/group or rotate if compromised.
Persistence & Privilege
Skill does not request always:true and is user-invocable (normal). It does not request persistent system-wide privileges or access to other skills' configs. Cron scheduling and connector usage are standard for ArkClaw-hosted skills.
Assessment
This skill appears coherent for its stated purpose. Before installing: (1) confirm the package metadata vs SKILL.md inconsistency — SKILL.md expects FEISHU_WEBHOOK; ensure the platform will prompt for it. (2) Create a dedicated Feishu group/webhook and use that rather than a shared or high-privilege channel, because the webhook URL lets whoever has it post messages. (3) Verify on ArkClaw/Volcengine which credentials/connectors are required (the SKILL.md assumes official ArkClaw connectors) and that you trust those connectors. (4) Inspect the GitHub project link if you want source-level assurance. If you need stricter guarantees, ask the author to explicitly list all required environment variables and connectors in the package metadata before enabling autonomous runs.Like a lobster shell, security has layers — review code before you run it.
latestvk97ds7s3tpt66wzweqfprdqw4x836zb8
License
MIT-0
Free to use, modify, and redistribute. No attribution required.