← Back to Skills Marketplace
232
Downloads
1
Stars
0
Active Installs
3
Versions
Install in OpenClaw
/install xhs-search-skill
Description
小红书关键词调研技能，提供小红书搜索关键词、提取笔记内容和评论的完整工作流。使用 AgentBay 沙箱浏览器 + Playwright 实现登录检测、关键词搜索、笔记结构化提取。当用户提到“帮我在小红书搜/查/看热点/找笔记/提取评论/做舆情分析”时应使用本 skill。首次使用时需要在沙箱浏览器完成登录，后续...
Usage Guidance
What to consider before installing and using this skill:
- Credentials: The skill requires an AgentBay API key (AGENTBAY_API_KEY) even though the registry metadata doesn't declare it. Do not put secrets into a repo file; prefer setting the API key as an environment variable rather than saving it in config.json.
- Logging exposure: The code currently logs the AgentBay API key to logs/ and console. Ask the author to remove or redact logging of secrets before using the skill. Inspect logs/ after any run and delete sensitive log files.
- status.md and session resource_url: The skill writes session_id and resource_url to status.md so you (or the agent) can complete remote login. Treat status.md as sensitive: do not share it. Anyone with a resource_url/session_id might be able to connect to the sandboxed browser — use a throwaway account if possible.
- Data flow to AgentBay: Extraction uses the AgentBay SDK (agent.extract). Page content and extracted text are processed by that service; confirm you are comfortable with the data reaching the AgentBay endpoint. Review the AgentBay SDK/package source (wuying-agentbay-sdk or the actual package name) before use.
- Fixes to request: The skill should be updated to (1) declare the required env vars/primary credential in metadata, (2) stop logging API keys, and (3) avoid writing sensitive resource URLs or full file paths into status.md or at least redact them. After those fixes, the design would be coherent for its stated purpose.
- Operational precautions: Use a dedicated account for Xiaohongshu login, configure proxies carefully, inspect and purge config.json and status.md after runs, and review log files for accidentally recorded secrets.
Capability Analysis
Type: OpenClaw Skill
Name: xhs-search-skill
Version: 1.0.2
The skill bundle provides a legitimate workflow for searching and extracting content from Xiaohongshu (XHS) using the Aliyun AgentBay sandbox browser service. The Python scripts (search_notes.py, extract_note.py, common.py) use standard libraries like Playwright and the official AgentBay SDK to automate browser sessions, handle logins, and perform AI-driven data extraction. While SKILL.md contains instructions to hide local file paths and raw JSON from the final user report, this appears to be a UX-focused design choice for clean summarization rather than a malicious evasion tactic. No evidence of data exfiltration, unauthorized persistence, or malicious code execution was found.
Capability Assessment
Purpose & Capability
The name/description (XHS keyword research via a sandboxed browser) match the code and scripts: the package uses an AgentBay-managed browser + Playwright to search and extract notes and comments. However the skill metadata declared no required environment variables or primary credential while the code clearly requires an AgentBay API key (agentbay_api_key / AGENTBAY_API_KEY). This metadata omission is inconsistent and reduces transparency for users.
Instruction Scope
Runtime instructions and scripts read and write config.json and status.md, persist a session_id, and create files under output/. The code writes resource_url and session_id into status.md (used to prompt remote login). The SKILL.md forbids exposing local paths to users, but the scripts write full file paths and file lists into status.md. More importantly, create_or_reuse_session logs the AgentBay API key (api_key) to logs/ and console, which could leak credentials. The skill also depends on the AgentBay service to perform page extraction (agent.extract) — expected for purpose, but this means page content and extracted data flow through the AgentBay SDK/service and the user should understand that remote endpoints see this data.
Install Mechanism
This is instruction + code shipped in the bundle with a requirements.txt. There is no remote download or opaque install hook. Dependencies (playwright and an AgentBay SDK) are reasonable for a headless-browser scraping skill. The lack of an explicit install spec in registry metadata is a minor hygiene issue but not a high-risk install mechanism by itself.
Credentials
The scripts require an AgentBay API key and optionally region/endpoint/timeouts and proxy settings — these are proportionate to the described integration. But the published metadata listed no required env vars or primary credential, which is misleading. Additionally, the skill favors config.json values over existing environment variables and will set AGENTBAY_API_KEY from config.json, which can encourage storing secrets in a repo file. The code also logs the API key to log files/console, increasing risk of credential exposure.
Persistence & Privilege
The skill persists a session_id in config.json and retains browser cookies in the AgentBay browser context so users stay logged across runs; this is expected for a scraping/login workflow. always:false and no changes to other skills or system-wide config are present. However, status.md and resource_url contain values that allow remote browser login/connection — treat those as sensitive because someone with resource_url + session_id may be able to access the sandboxed browser.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install xhs-search-skill - After installation, invoke the skill by name or use
/xhs-search-skill - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.2
xhs-search-skill 1.0.2
- 新增脚本 `scripts/check_env.py`，支持一键检查依赖和 AgentBay API Key/连接配置。
- 更新文档，明确将环境检查作为入口步骤，缺少 API Key 时需先引导用户配置开通。
- 全流程梳理：环境检查、登录校验、关键词扩展与确认、再执行搜索/提取及结果摘要。
- 明确规定不可向用户展示本地中间文件或路径，仅输出结构化分析结论。
v1.0.1
- 默认每个关键词采集条数由 5 调整为 3，max_notes_per_keyword 默认值更新。
- 相应地，用户未特别说明时，每个关键词采集量默认为 3 条，可适当提高上限至 5-10。
- 其余使用方法、配置流程、整体说明保持不变。
v1.0.0
Initial release of xhs-keyword-research skill—an end-to-end workflow for Xiaohongshu keyword search and content extraction.
- Provides complete process: login check, keyword search, structured note and comment extraction using AgentBay sandbox browser + Playwright.
- Supports interactive user login flow and automated session management.
- Enables keyword expansion, configurable search and extraction parameters.
- Automatically summarizes extracted content for user, focusing on insights—not raw data.
- Designed for easy configuration, with clear prompts and step-by-step guidance.
Metadata
Frequently Asked Questions
What is xhs-search-skill?
小红书关键词调研技能，提供小红书搜索关键词、提取笔记内容和评论的完整工作流。使用 AgentBay 沙箱浏览器 + Playwright 实现登录检测、关键词搜索、笔记结构化提取。当用户提到“帮我在小红书搜/查/看热点/找笔记/提取评论/做舆情分析”时应使用本 skill。首次使用时需要在沙箱浏览器完成登录，后续... It is an AI Agent Skill for Claude Code / OpenClaw, with 232 downloads so far.
How do I install xhs-search-skill?
Run "/install xhs-search-skill" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is xhs-search-skill free?
Yes, xhs-search-skill is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does xhs-search-skill support?
xhs-search-skill is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created xhs-search-skill?
It is built and maintained by 李狗蛋 (@ligoudanblabla); the current version is v1.0.2.
More Skills