小红书自动化

小红书自动化操作 - 发布笔记、管理账号、数据爬取、定时发布。使用浏览器自动化模拟真人操作。

Key things to consider before installing/running: - Do not run this against your main account until you confirm behavior with a disposable/test account: the bot stores session state locally and may contain auth cookies/tokens. - The metadata/install says 'puppeteer' but the code and package.json use 'playwright' — verify which package will actually be installed and that it matches the shipped code. Installing the wrong package could change runtime behavior. - The README/SKILL.md claim session encryption but the code writes JSON to the session path without encryption — assume the session file is plaintext unless you audit and modify the code to add real encryption. - Playwright/puppeteer will download browser binaries during install (large downloads). Prefer to run in a controlled environment (VM/container) and inspect network activity if you're concerned. - If you decide to proceed: review and test the code (scripts/xhs-bot.js), confirm where session files are written, consider encrypting or restricting permissions on the session file, run with a throwaway account first, and fix the install metadata mismatch so the declared install matches the actual dependency. If you want, I can point out the exact lines in scripts/xhs-bot.js that are misleading or help craft a minimal patch to actually encrypt session files or to align the install spec with the code.

Type: OpenClaw Skill Name: xhs-bot-raininjunezz Version: 1.0.0 The skill bundle provides legitimate browser automation for the Xiaohongshu platform using Playwright. The code in `scripts/xhs-bot.js` implements expected features such as note publishing, data scraping, and session management, with session data stored strictly in a local directory (~/.openclaw/xiaohongshu/). No evidence of data exfiltration, malicious remote execution, or harmful prompt injection was found; the implementation aligns perfectly with the stated purpose in SKILL.md and README.md.