XHS Video Downloader

Download videos from Xiaohongshu (小红书) pages. Use when the user wants to save or download a video from a xiaohongshu.com URL, or mentions "小红书视频下载", "保存小红书视频...

This skill appears to do exactly what it claims: fetch a Xiaohongshu page, find the CDN/video URL, and download the file. Before installing/using it: 1) Be sure downloading the video complies with Xiaohongshu's terms and copyright law. 2) You must have Python3 and the 'requests' package (pip install requests) to run the script; the SKILL.md does not auto-install dependencies. 3) The tool will make network requests to whatever URL you supply and save files to ~/Downloads/xiaohongshu — do not pass untrusted or unknown URLs. 4) For pages requiring JS rendering, follow the browser automation method (it runs a small JS snippet in the page context to locate .mp4 URLs). 5) If you need stronger assurances, inspect or run the Python script in a sandbox before use.

Type: OpenClaw Skill Name: xhs-video-downloader Version: 1.0.0 The skill's stated purpose of downloading Xiaohongshu videos is legitimate. The `SKILL.md` instructions for the AI agent are clear and do not show signs of prompt injection or malicious intent. However, the `scripts/download_video.py` file contains a path traversal vulnerability. The script constructs the output file path using user-provided `output_dir` and `--filename` arguments without sufficient sanitization, which could allow an attacker to write files to arbitrary locations on the filesystem (e.g., `../../etc/passwd`) if a malicious path is supplied via prompt injection to the agent or direct execution.