Xhs Skill

小红书（创作者中心）登录拿 cookies、发布笔记、导出数据的单一入口技能（浏览器交互委托 agent-browser-stealth）

This skill appears to do what it says: local helpers plus enforcement scripts around Xiaohongshu login, cookie export/normalization, payload verification and review. Before installing: (1) Review and run the included scripts locally to confirm behavior—they read/write files under data/ and config/, and will export cookies (these cookies can grant account access if mishandled). (2) If you enable the review script's AI features, ensure you understand which API key will be used (OpenAI keys are not declared in registry); only provide credentials you trust. (3) The SKILL.md enforces a strict response/output format (scanner flagged this as a potential prompt-override); this is probably harmless formatting guidance but be cautious about workflows that require pasting sensitive tokens into chat. (4) 'npm i' pulls only image/QR-related packages — if you prefer, inspect package.json and node_modules before running. If you need higher assurance, ask the author for a signed source/homepage or for explicit confirmation about whether any network calls (beyond optional AI calls) are performed by the scripts.

Type: OpenClaw Skill Name: xhs-skill Version: 1.0.15 The skill is classified as suspicious primarily due to the `scripts/review_publish_payload.mjs` script making external API calls to OpenAI (or a configurable `OPENAI_BASE_URL`) for content moderation. This involves sending user-generated content (title, body, tags, and potentially base64-encoded images) to a third-party service. While the stated purpose is benign (content review and anti-AI measures), this capability represents a significant data privacy concern and a potential data exfiltration vector if the API key or the external service were compromised, or if the skill's true intent were malicious. Additionally, the `SKILL.md` instructs the AI agent to execute various shell commands (`node`, `agent-browser-stealth`, `sips`), which introduces a vulnerability risk if the agent's command execution mechanism does not robustly sanitize all user-provided inputs before execution, potentially leading to shell injection.