XHS Research Daily

Collect Xiaohongshu posts/comments for a research topic, synthesize a daily roundup, and optionally publish it back to Xiaohongshu. Use when building or runn...

This skill appears to implement what it claims, but review these before installing/using: 1) mcporter is a required runtime dependency even though the registry metadata lists none—ensure you install the official mcporter binary from a trusted source. 2) The client uses the MCPORTER_CONFIG_PATH env var if present, otherwise it falls back to a hardcoded path (/Users/ailor/.openclaw/workspace/config/mcporter.json). Check and, if needed, override MCPORTER_CONFIG_PATH so it points to the correct config on your machine; verify that file's contents (it likely contains tokens/credentials). 3) Because the skill calls a local binary via subprocess, ensure no untrusted mcporter is on PATH (an attacker could replace it). 4) Use --dry-run and inspect data/<topic>/<date>/processed/post_draft.json before running with --publish. 5) If you do use publishing, limit which account the mcporter config logs into and confirm you are comfortable with the skill having the ability to publish on that account. If you want greater assurance, ask the author to: declare mcporter as a required binary, declare MCPORTER_CONFIG_PATH in metadata, and remove or parameterize the hardcoded default config path.

Type: OpenClaw Skill Name: xhs-research-daily Version: 0.1.0 The skill bundle is a functional tool designed to automate research and posting on Xiaohongshu. It uses a subprocess-based client (xhs_client.py) to interact with an external utility called 'mcporter'. While it handles external commands, it includes an input sanitization method (_escape) to mitigate injection risks, and its behavior is entirely consistent with the stated purpose of data collection and synthesis. No evidence of data exfiltration, unauthorized access, or malicious prompt injection was found.