xhs-publisher-pro

小红书通用自动发帖技能。全流程自动化：AI生成帖子内容 → 生成封面图（6套风格模板）→ Puppeteer自动发布到小红书创作者中心。内置 stealth 反风控、人类化打字模拟。适合运营任意垂直领域小红书账号（科技、生活、美食、旅行、节日、知识分享等）。当用户需要自动发小红书帖子、生成封面图、或定时发帖时使用。

This skill is broadly consistent with its stated purpose (it uses Puppeteer + stealth to automate posting and generates cover images), but there are a few things to consider before installing or running it: - Postinstall behavior: npm install will run postinstall.js which probes for Chrome and attempts to auto-install Chromium via apt-get/dnf/yum/brew or trigger a Puppeteer internal download. That can invoke system package managers or long-running downloads. If you don't want automatic system installs, review and run postinstall.js manually or run npm with scripts disabled (e.g., npm ci --ignore-scripts) and then perform required steps yourself. - Sensitive inputs: You will need to provide a phone number and SMS verification code for first-time login. Sessions are saved locally to ~/.openclaw-sessions/xiaohongshu by default. Inspect the code to confirm there is no network upload of session files before trusting it; the provided files claim local-only storage, but you should verify no outbound network code exists in any code not shown to you. - Prompt-injection marker: A unicode-control-chars pattern was detected in the SKILL.md. This is not necessary for the skill's functionality and could be an attempt to manipulate LLM behavior. Inspect the SKILL.md raw text for hidden control characters and remove them. - Safety precautions: run the code in an isolated environment (VM or disposable container) first, review postinstall.js and xhs_publisher.js for any network/upload calls you don't expect, and consider creating a throwaway test account instead of your real account until you are confident. If you allow postinstall to run system package managers, be prepared for it to try installing packages that require root privileges.

Type: OpenClaw Skill Name: xhs-publisher-pro Version: 1.4.0 The skill bundle is a legitimate automation tool for Xiaohongshu (XHS) content publishing. It uses Puppeteer with stealth plugins to simulate human behavior and includes a built-in content safety filter (checkContentSafety) in xhs_publisher.js to prevent account bans. The scripts handle environment setup and session persistence locally within the user's home directory (~/.openclaw-sessions/), with no evidence of data exfiltration, malicious remote execution, or unauthorized access to sensitive system files.