← 返回 Skills 市场
xhs-kit-publisher
作者
Glittering
· GitHub ↗
· v1.0.0
520
总下载
1
收藏
2
当前安装
1
版本数
在 OpenClaw 中安装
/install xhs-kit-publisher
功能描述
使用xhs-kit Python库高效发布小红书内容，无需浏览器，支持多账号和定时发布
安全使用建议
This skill looks like a legitimate wrapper around the xhs-kit tooling, but review and verify before running:
- Verify xhs-kit source: check the upstream GitHub/PyPI project (the SKILL.md links a placeholder GitHub). Confirm the xhs-kit package is trustworthy before pip installing.
- Use an isolated Python virtualenv and inspect requirements.txt; don't run pip install globally.
- Playwright installs browser binaries — if you truly want no browser, ask the author to explain why Playwright is required.
- Cookie files contain account authentication. Treat them as secrets: store them with appropriate file permissions, do not upload them to unknown services, and avoid reusing cookies from unknown sources.
- The instructions include 'rm -rf ~/.config/xhs-kit' — do not run destructive commands unless you understand consequences.
- Ask the skill author to explicitly declare required env vars/paths and justify any config paths it reads/writes. If you need stronger assurance, request a link to the official xhs-kit repository (not a placeholder) and inspect that project's code and release artifacts before use.
功能分析
Type: OpenClaw Skill
Name: xhs-kit-publisher
Version: 1.0.0
The skill provides a framework for automating Xiaohongshu (XHS) posts, which involves high-risk behaviors such as managing session cookies and using browser automation (Playwright). While these actions align with the stated purpose, the bundle contains several red flags: a contradiction where it claims 'no browser' while requiring a Chromium installation, the use of a placeholder GitHub URL (github.com/xxx/xhs-kit) for its core dependency, and the practice of storing sensitive session cookies in plaintext JSON files (e.g., config/account1_cookies.json). No explicit evidence of data exfiltration or malicious intent was found in the provided files, but the reliance on an unverified external library for credential handling is a significant risk.
能力评估
Purpose & Capability
Name/description match the instructions: SKILL.md describes using the xhs-kit Python library to publish to 小红书 and the included requirements and example commands (pip install xhs-kit, xhs-kit publish, QR login) are coherent with that purpose. Minor contradiction: the description claims '无需浏览器' yet the instructions and requirements include Playwright and 'playwright install chromium', which will download browser binaries. This could be explainable (headless browser used for login), but it's a mismatch between marketing text and install steps.
Instruction Scope
SKILL.md instructs the agent/user to create and delete local config (~/.config/xhs-kit), save and use cookie files (config/account1_cookies.json), set environment variables (XHS_COOKIES_FILE, XHS_IMAGE_DIR, XHS_PUBLISH_INTERVAL), run login flows (QR code) and publish commands. These operations touch local credentials (cookies) and user config directories; the skill's metadata did not declare these as required config/credentials. The instructions also include commands that remove config directories (rm -rf ~/.config/xhs-kit), which is potentially destructive and should be performed deliberately by the user.
Install Mechanism
This is an instruction-only skill (no install spec), but SKILL.md and package.json recommend pip installing packages from PyPI and running 'playwright install chromium', which downloads browser artifacts. Installing packages from PyPI and Playwright is a common and expected mechanism here but carries the usual risks: verify the xhs-kit package source (PyPI/GitHub) before installing, and run installs inside an isolated virtualenv. There is no direct download-from-unknown-URL in the skill bundle itself.
Credentials
Registry metadata declares no required environment variables or credentials, yet the instructions reference multiple environment variables (XHS_COOKIES_FILE, XHS_IMAGE_DIR, XHS_PUBLISH_INTERVAL) and rely on cookie files that effectively contain authentication for accounts. The skill suggests creating and using cookie files (sensitive material) but does not declare or justify how secrets/config are handled. This mismatch is a data-exfiltration risk if cookie files are mismanaged or uploaded inadvertently.
Persistence & Privilege
The skill is not set to always:true and does not request system-wide privileges. It is instruction-only and has no bundled code that would persist on the system other than what the user explicitly installs (pip packages, Playwright). The agent may invoke it autonomously by default (disable-model-invocation is false), which is normal platform behavior but increases the importance of the other flagged concerns.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install xhs-kit-publisher - 安装完成后，直接呼叫该 Skill 的名称或使用
/xhs-kit-publisher触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.0
初始发布：使用xhs-kit高效发布小红书内容，无需浏览器，支持多账号和定时发布
元数据
常见问题
xhs-kit-publisher 是什么？
使用xhs-kit Python库高效发布小红书内容，无需浏览器，支持多账号和定时发布. 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 520 次。
如何安装 xhs-kit-publisher？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install xhs-kit-publisher」即可一键安装，无需额外配置。
xhs-kit-publisher 是免费的吗？
是的，xhs-kit-publisher 完全免费（开源免费），可自由下载、安装和使用。
xhs-kit-publisher 支持哪些平台？
xhs-kit-publisher 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 xhs-kit-publisher？
由 Glittering（@glittering）开发并维护，当前版本 v1.0.0。
推荐 Skills