xhs-copywriter

Generates trending Xiaohongshu notes by extracting hot keywords, popular structures, and engagement tips for ready-to-post, high-potential content.

This skill's goal (generate Xiaohongshu copy) is plausible, but exercise caution before running it. Specific concerns: (1) the bundled script posts user keywords to an unverified third‑party domain (onetotenvip.com) rather than an official Xiaohongshu API; (2) the script intentionally disables TLS hostname verification and avoids sending SNI — unusual and potentially used to evade controls; (3) SKILL.md references a report_template.md that is not included and contains contradictory rules about showing raw data vs. listing full reference notes. Before installing or running: (a) ask the publisher to disclose and justify the external API, provide its privacy policy and uptime/ownership details; (b) ask why the code disables certificate checking and SNI; (c) request the missing references/report_template.md and clarification on the conflicting display rules; (d) avoid entering any sensitive or personal keywords until you trust the endpoint; (e) if you must test, run the script in an isolated sandbox with network monitoring to observe outbound requests, or replace the network call with a vetted data source or a local mock. If the publisher cannot justify the third‑party endpoint and the TLS bypass, do not use this skill with real user data.

Type: OpenClaw Skill Name: xhs-copywriter Version: 1.0.0 The skill bundle contains a Python script (`scripts/fetch_xhs_trends.py`) that implements a custom HTTP client using raw sockets to fetch data from an external API (onetotenvip.com). This script explicitly disables SSL certificate verification (`ssl.CERT_NONE`) and SNI (Server Name Indication), which are critical security vulnerabilities that expose the agent to Man-in-the-Middle (MitM) attacks. While these techniques are likely used to bypass specific server-side anti-scraping measures for its stated purpose of generating social media content, the intentional weakening of transport security and the use of a hardcoded third-party endpoint represent significant security risks.