Xhs Surfer

小红书智能浏览器自动化工具，AI驱动的社区冲浪和互动。 支持自动搜索、浏览、点赞、评论、关注等操作。 当用户要求浏览小红书、搜索内容、自动互动时触发。

This skill automates account actions (likes, comments, follows) and can read local cookies files and private messages — anything that gives it your cookies, credentials, or API keys can be used to act as your account. Before installing or running it: 1) Review the xhs-surfer PyPI package and its GitHub repo source code yourself to ensure it does what it claims. 2) Do not supply real account cookies/credentials or primary API keys to an untrusted package; prefer a throwaway/test account when experimenting. 3) Be cautious about providing LLM API keys — the SKILL.md references OPENAI/QWEN keys but they are not declared in metadata. 4) If you proceed, run the package in an isolated environment (VM/container) and limit network/proxy access; verify rate limits and safety settings to avoid account bans. 5) If you need the agent to act on private data (cookies, messages), accept that those items will be accessed — only proceed if you trust the package and have audited its code.

Type: OpenClaw Skill Name: xhs-surfer Version: 1.0.0 The xhs-surfer skill is a browser automation tool for Xiaohongshu that handles sensitive session cookies and requires external LLM API keys for automated interactions. While the functionality aligns with its stated purpose, the handling of authentication tokens and a discrepancy in the metadata—specifically a typo in the homepage URL (xhs_suffer vs xhs-surfer)—are indicators of potential risk or deceptive sourcing. The tool's high-privilege actions (automated social media engagement and credential management) warrant caution as they could be leveraged for account misuse if the underlying PyPI package is compromised.