Xhs

小红书全能助手 — 文案生成、封面制作、内容发布与管理。当用户要求写小红书笔记、生成小红书文案/标题/封面、发小红书、搜索小红书、评论点赞收藏等任何小红书相关操作时使用。支持一站式从文案创作到自动发布的完整流程。封面图使用纯ImageMagick生成，无需API配置。

This skill broadly does what it claims (title/content generation + ImageMagick covers + calls to a local MCP service) but contains several red flags you should consider before installing or running it: - Origin and binary trust: The scripts expect a local binary at ~/xiaohongshu-mcp/xiaohongshu-mcp-linux-amd64 and systemd unit 'xhs-mcp', but the skill provides no install source or signature. Do not run or start that binary unless you have obtained it from a trusted repository and verified it. - Undeclared dependencies: The metadata only lists 'convert' and 'curl', but scripts also call python3, md5sum, fc-list/identify (ImageMagick identify), jq (in SKILL.md examples), systemctl, pgrep, Xvfb and more. Ensure your environment meets these needs and inspect scripts before granting permission to run them. - Sensitive environment/config access: The scripts reference multiple optional API keys (GEMINI_API_KEY, IMG_API_KEY, HUNYUAN_* , XHS_AI_*). The skill will also read ~/.openclaw/openclaw.json. Only set or expose API keys if necessary and you trust where data will be sent. If you don't want networked image/AI calls, do not provide those keys. - Service/startup behavior: check_env.sh will try to start Xvfb and the MCP service (via systemctl or nohup). Starting system services or background binaries has system-level impact — run these steps in a controlled environment (VM/container) first, and avoid running as root. - What would reduce risk: a public homepage/repository, signed/releases for the MCP binary, an explicit install spec that fetches the binary from a reputable host (GitHub releases with checksum/signature), or trimmed scripts that only require the declared binaries and do not attempt to start system services. Recommendation: Do not run the MCP binary or the environment-starting scripts until you verify the binary's provenance. If you want only the cover generation and content templates, consider running scripts (cover.sh, generate.sh) in an isolated environment after reviewing them. If you plan to enable publish/search features, obtain and audit the MCP implementation and its source first.

Type: OpenClaw Skill Name: xhs-text-cover Version: 1.0.0 The skill bundle facilitates Xiaohongshu automation but performs several high-risk operations, including downloading and executing a remote binary from GitHub (xpzouying/xiaohongshu-mcp), creating systemd services for persistence, and requesting/storing raw browser cookies in '~/xiaohongshu-mcp/cookies.json'. It also utilizes Xvfb and xdotool for GUI automation and reads the user's global OpenClaw configuration file. While these actions are documented as necessary for the tool's functionality, the combination of remote binary execution and sensitive credential handling warrants a suspicious classification.