PigBun RedNote

小红书AI运营工具，支持搜索、发布笔记，评论管理，社交互动及数据分析的一站式自动化解决方案。

This skill appears to do what it says (web automation for 小红书) but depends on a third‑party service (pigbunai.com) and an interactive QR login whose token storage/handling are unspecified. Before installing: 1) Verify pigbunai.com is trustworthy (company, privacy/terms, contact); 2) Ask the skill/vendor for source code or a clear description of what `openclaw rednote init` stores and where session tokens/API requests are sent; 3) Use a throwaway or test Xiaohongshu account when first trying it; 4) Limit the plugin to specific tasks and disable it when not needed; 5) Check OpenClaw plugin config storage and rotation/revocation options for the apiKey; 6) Avoid giving it high-value accounts (payment info, business accounts) until you confirm behavior; 7) If you need a higher assurance, request a signed/hosted implementation or audited code before use.

Type: OpenClaw Skill Name: pigbun-rednote Version: 0.8.1 The skill bundle is classified as suspicious due to its broad and powerful capabilities, which inherently carry significant risk, even without explicit malicious instructions in the provided documentation. It requires an external API key from `pigbunai.com`, necessitates running system commands (`npx playwright install chromium`) as a prerequisite, and involves handling user authentication (QR code login via `openclaw rednote init`) for full control over a Xiaohongshu account. While these actions are plausibly needed for the stated purpose of an 'AI operations tool,' the extensive permissions (publishing, editing, deleting content, social interaction, accessing analytics) create a large attack surface if the underlying, unseen code were malicious or compromised, potentially leading to account takeover, data exfiltration, or unauthorized content posting.