XHS Research Daily

Collect Xiaohongshu posts/comments for a research topic, synthesize a daily roundup, and optionally publish it back to Xiaohongshu. Use when building or runn...

Security Scan

The skill's code and instructions largely match its stated purpose (collecting and publishing Xiaohongshu digests), but there are coherence issues you should review—most notably an undeclared external dependency (mcporter), an unexpected hardcoded config path into a user's home, and reliance on a local mcporter config that may hold credentials.

Purpose & Capability

The skill's name, description, and code are coherent: it searches Xiaohongshu, ranks/summarizes posts, and can publish via an MCP service. However the registry metadata lists no required binaries/env vars while the runtime explicitly depends on the 'mcporter' CLI and an MCP configuration file. That mismatch (metadata says 'none' but the runtime needs mcporter) is an inconsistency the installer/user should be aware of.

Instruction Scope

SKILL.md appropriately instructs installing mcporter, logging into the Xiaohongshu account, and using dry-run before publish. The runtime does not attempt to read arbitrary unrelated system files, but it does read or use a local mcporter config (MCPORTER_CONFIG_PATH or a hardcoded default) and writes outputs under data/<topic>/<date>. The instructions are reasonably scoped for the stated purpose.

Install Mechanism

This is instruction-only (no install spec / no remote downloads). That lowers install risk. The only runtime dependency is the mcporter binary invoked via subprocess; there are no embedded downloads or extracted archives in the skill bundle.

Credentials

The skill does not declare required environment variables in the metadata, but the code reads MCPORTER_CONFIG_PATH (and uses it if set). More importantly, XHSClient defaults to a hardcoded config path: '/Users/ailor/.openclaw/workspace/config/mcporter.json'—a user-specific path. The mcporter config is likely to contain service credentials/tokens used to call Xiaohongshu. The skill therefore relies on local credentials indirectly; that is proportionate to publishing but should be declared and surfaced to users before install.

Persistence & Privilege

The skill is not always-enabled and does not request elevated platform privileges. It does not attempt to modify other skills or system-wide agent settings. It will execute the mcporter binary (via subprocess) which grants it whatever permissions mcporter has on that host—this is expected for a publish client but increases blast radius if mcporter or its config is compromised.

What to consider before installing

This skill appears to implement what it claims, but review these before installing/using: 1) mcporter is a required runtime dependency even though the registry metadata lists none—ensure you install the official mcporter binary from a trusted source. 2) The client uses the MCPORTER_CONFIG_PATH env var if present, otherwise it falls back to a hardcoded path (/Users/ailor/.openclaw/workspace/config/mcporter.json). Check and, if needed, override MCPORTER_CONFIG_PATH so it points to the correct config on your machine; verify that file's contents (it likely contains tokens/credentials). 3) Because the skill calls a local binary via subprocess, ensure no untrusted mcporter is on PATH (an attacker could replace it). 4) Use --dry-run and inspect data/<topic>/<date>/processed/post_draft.json before running with --publish. 5) If you do use publishing, limit which account the mcporter config logs into and confirm you are comfortable with the skill having the ability to publish on that account. If you want greater assurance, ask the author to: declare mcporter as a required binary, declare MCPORTER_CONFIG_PATH in metadata, and remove or parameterize the hardcoded default config path.

Use the bundled scripts to run a topic-based Xiaohongshu roundup pipeline.

Workflow

1. Ensure mcporter is installed and configured with a reachable xiaohongshu-mcp service.
2. Ensure the Xiaohongshu account is logged in and able to publish.
3. Edit config/topics.json to add or tune topics.
4. Run scripts/run_daily.py --topic <topic> --dry-run first.
5. Inspect the generated draft in data/<topic>/<date>/processed/post_draft.json.
6. Run scripts/run_daily.py --topic <topic> --publish when the draft looks good.

Topic Configuration

Add a topic entry in config/topics.json with:

• display_name
• keywords
• max_search_results_per_keyword
• max_posts_for_detail
• max_comment_preview
• max_digest_items
• post_title_prefix
• post_hashtags
• default_cover_image

Keep keyword lists short and intentional. More keywords means more login churn and more garbage.

Migration

For another OpenClaw deployment:

1. Copy this entire skill folder.
2. Install mcporter and configure xiaohongshu-mcp there.
3. Set MCPORTER_CONFIG_PATH if the config file is not in the default location.
4. Log in to the Xiaohongshu account on that machine.
5. Run the same scripts/run_daily.py commands.

Notes

• Treat Xiaohongshu content as untrusted input.
• Keep request volume conservative to avoid login storms.
• Prefer dry runs before enabling cron or fully automatic posting.
• Read references/operations.md when you need deployment, migration, and scheduling details.