人群宇宙投放追踪周报

人群宇宙投放追踪周报自动生成工具。支持任意行业（家清、美妆、母婴、食品等），只需提供 RedBI 看板地址和行业人群包名称，自动拉取数据、对比人群宇宙 vs 整体种草效果、按三类逻辑分层客户优先级（未投放/效果好投入少/数据不及整体），生成可视化 HTML 周报和 Redoc 在线文档。触发词：人群宇宙周报、人群...

This appears to be an internal reporting tool that legitimately needs access to your company's RedBI data, so its behavior (reading an SSO cookie, calling internal APIs, downloading CSVs and images, generating HTML and publishing Redoc) makes sense — but there are important transparency gaps: the skill metadata does not declare the SSO credential or the dependency on another skill's run-sso.sh helper, nor does it list required runtime tools (bunx, @xhs/hi-workspace-cli, Python libs). Before installing or enabling: 1) Confirm you trust the skill author and that this will run only in a controlled internal environment. 2) Verify the presence and safety of /home/node/.token/sso_token.json and /app/skills/data-fe-common-sso/script/run-sso.sh (audit those files). 3) Ensure required runtimes (bunx, Python packages) are available and that publishing to Redoc uses internal endpoints only. 4) Be aware the skill will start a local HTTP preview (pod_ip:18765) — confirm that serving this port is allowed and not exposed to public network. If you need higher assurance, ask the maintainer to update metadata to declare required config paths/credentials and dependency tools or to provide a reviewed install manifest.

Type: OpenClaw Skill Name: xhs-universe-weekly Version: 1.1.0 The skill bundle automates internal business reporting for Xiaohongshu (XHS) employees, requiring high-risk capabilities such as reading SSO tokens from the filesystem (`/home/node/.token/sso_token.json`), executing shell scripts (`fetch_data.sh`), and starting a local HTTP server for report previews. While these actions are aligned with the stated purpose of fetching data from internal BI tools (`redbi.devops.xiaohongshu.com`) and publishing to internal documentation platforms (`docs.xiaohongshu.com`), the use of sensitive credentials and shell execution meets the criteria for a 'suspicious' classification despite the lack of clear malicious intent.