Xiaohongshu Auto Publish

小红书自动发布技能 - AI 文案 + 中国风封面 + 一键发布

Do not run this on a production or personal machine without review. Specific things to consider before installing or running: - Hard-coded API key: The repository contains a SkillPay API key embedded in multiple files and ACCOUNTS.md. If you don't trust the author, do not use that key — rotate it or remove it. Prefer configuring your own API key via an environment variable rather than using the embedded value. - Absolute, user-specific paths: The code references /Users/xiaofang/.openclaw/... and other local cookie paths. These will likely fail on your machine and could cause the skill to access local config files if you adapt it. Inspect any references to ~/.openclaw or cookies.json before running. - Missing files/dependencies: skill.py expects generate_cover_chinese.py, a generate_content module, and an xhs_client.py under a specific path, but these are not included. The package appears incomplete — verify and audit the missing components before use. - Network and subprocess behavior: The skill will call external endpoints (skillpay.me) and run local binaries (clawhub, xhs client). Run it in a sandbox or container first, and inspect or stub the xhs_client and payment verification calls if you want to test functionality safely. - If you intend to use it: replace the embedded API key with your own, declare it via a secure environment variable, audit xhs_client and any MCP code it invokes, and remove or correct absolute paths. If you don't control the SkillPay account associated with the embedded key, do not use that key — it could result in charges, unexpected behavior, or leaking of usage data. Given the mix of sensitive embedded data and packaging inconsistencies, treat this skill as untrusted until you or the author fixes the issues above.

Type: OpenClaw Skill Name: xiaohongshu-auto-publish Version: 1.0.0 The skill bundle contains a hardcoded sensitive API secret key (sk_4eacbcc9e4411bd1490794b27867199f9801e3150b4c354541e6a2927931a06e) across multiple files, including skill.py, publish.sh, and configure_skillpay.py. It also relies heavily on hardcoded absolute file paths (e.g., /Users/xiaofang/...) which are non-portable and indicate a poorly secured or environment-specific configuration. While the logic appears to fulfill the stated purpose of automating Xiaohongshu posts, the integration with an external payment verification service (skillpay.me) and the exposure of credentials represent significant security vulnerabilities.