rednote-ranking-data

想知道小红书哪些账号涨粉最猛？这款技能帮你追踪日榜/周榜/月榜涨粉数据，数据都是人工一个个账号比对校验出来的，覆盖全品类，还能一键生成好看的排名图！

Before installing or running this skill: 1) Be cautious about network calls — the scripts contact an external domain (onetotenvip.com) with TLS verification disabled and SNI suppressed; ask the author why this is necessary and verify the endpoint's reputation. 2) Expect the skill to write files (subscriptions.json) and copy outputs to your Desktop. 3) The skill can send emails/WeChat messages and thus will need SMTP credentials and WeChat appid/secret — these are not declared in the metadata; do not provide credentials unless you trust the code and operator. 4) If you want to proceed, run it in an isolated/sandboxed environment, review the full source, and request the developer to: (a) remove or justify disabling TLS verification/SNI, (b) declare needed environment variables in metadata, and (c) provide documentation for the data source and its legal/ethical sourcing. If the developer cannot satisfactorily explain the TLS choices and data provenance, avoid providing sensitive credentials or using the skill on production systems.

Type: OpenClaw Skill Name: rednote-ranking Version: 1.0.0 The skill bundle contains high-risk security flaws and intrusive file system behaviors. Specifically, `scripts/query_rankings.py` implements a custom HTTPS client that explicitly disables SSL certificate verification (`ssl.CERT_NONE`) and SNI, which exposes the agent to Man-in-the-Middle (MITM) attacks when communicating with the data source (onetotenvip.com). Additionally, `scripts/export_to_excel.py` and `scripts/generate_ranking_image.py` automatically copy generated files to the user's desktop (`~/Desktop`), which is an intrusive operation. While these appear to be functional choices for the stated purpose, the combination of insecure networking and broad file access is highly risky.