小红书商业洞察与竞品分析助手

小红书运营全链路数据工具｜支持关键词搜索/笔记详情查询/爆款挖掘/竞品分析/KOL筛选/趋势洞察，基于Node.js开发，可获取小红书图文/视频笔记的点赞/评论/收藏数据，用数据驱动小红书流量增长，告别盲目创作

This skill appears to do what it says: it runs Node CLI scripts that call a third‑party API to fetch Xiaohongshu public data. Before installing/running: 1) Verify you trust the external API provider (www.guaikei.com) because the tool will send queries and note URLs to that host. 2) Provide your own GUAIKEI_API_TOKEN instead of relying on the embedded default demo token; check the provider's terms and rate limits. 3) Be aware the tool writes results to a local logs/ directory — do not run it on systems containing sensitive data you don't want logged. 4) Review the upstream GitHub repository (package.json points to github.com/um-why/xiaohongshu-openclaw-skill) and the provider's privacy/usage policies if you need higher assurance. If you need me to, I can summarize the exact network calls the skill makes or help verify the external domain's reputation.

Type: OpenClaw Skill Name: xiaohongshu-tool Version: 1.0.2 The skill bundle is a legitimate data mining tool for Xiaohongshu (Red) analytics, acting as a wrapper for the Guaikei API. It implements robust input validation for keywords (src/validate/keyword.js) and URLs (src/validate/url.js) to prevent injection, uses standard Node.js HTTPS modules without external dependencies to minimize supply chain risks, and includes clear documentation for the OpenClaw agent. No evidence of data exfiltration, malicious execution, or prompt injection was found; the use of a hardcoded default API token (src/utils/key.js) is transparently handled as a fallback for trial purposes.