xhs-research

小红书调研工具 — 搜索小红书笔记，AI 合成调研报告。

This skill appears to do what it says: it runs a local MCP service, asks you to scan a Xiaohongshu QR code, and uses downloaded binaries to perform searches and produce reports. Before installing: - Inspect and verify the upstream GitHub project (xpzouying/xiaohongshu-mcp) and its releases; malicious actors can publish binaries to a release asset. - If you don't trust those binaries, don't run setup.py; you can audit source or build binaries yourself. - Be aware the skill saves login cookies (~/.local/share/xhs-research/cookies.json) and will launch Chrome for QR login; treat that file as sensitive and delete it when you no longer need the skill. - Note the optional XIAOHONGSHU_API_BASE env var can redirect network calls — ensure it is not set to an untrusted remote endpoint. - Run the skill in a controlled environment (or sandbox) if you want additional safety, and remove the ~/.local/share/xhs-research directory after use.

Type: OpenClaw Skill Name: xhs-research Version: 1.0.0 The xhs-research skill is a comprehensive tool for automated Xiaohongshu market research, featuring sophisticated search, deduplication, and scoring logic in `scripts/xhs_research.py`. While the skill performs high-risk actions such as downloading and executing external binaries from GitHub (`scripts/setup.py`) and managing session cookies (`scripts/login.py`), these behaviors are transparently documented and strictly necessary for the stated purpose of interacting with the Xiaohongshu platform. The instructions in `SKILL.md` are well-structured, focusing on data accuracy and source attribution, with no evidence of malicious intent, data exfiltration, or unauthorized persistence.