小红书转Obsidian

Extract Xiaohongshu (小红书) posts into Obsidian notes. Use when user shares a Xiaohongshu link and wants to save it as a markdown note. Supports single posts,...

This skill appears to do what it says (scrape Xiaohongshu posts and optionally transcribe videos), but exercise caution before installing/using it: - Sensitive cookies: The tool requires you to export your Xiaohongshu cookies (session tokens) and save them to a local JSON file. Those cookies grant access to your account and should be treated like a password — do NOT share them. Consider creating a throwaway account if you are unsure. - Plaintext storage: Cookies are stored in plaintext in your home directory by default; remove or rotate them after use and restrict file permissions (chmod 600) if you keep them. - TLS verification disabled: extract_post.py creates an SSL context with certificate verification disabled (ssl.CERT_NONE). This reduces protection against network-level interception (MITM). If you only run this on trusted networks, risk is lower, but ideally the script should be modified to enable verification. - Inconsistent defaults: SKILL.md and extract_post.py disagree on the default cookie path; always pass explicit --cookies and --output arguments to avoid surprises. - Review code before running: The repository is small and readable — inspect the scripts yourself or run them in a sandboxed environment first. If you accept the risks, run with an account you can afford to expose and remove stored cookies after use. If you want, I can point out the exact lines to change to re-enable SSL verification and to harmonize the default cookie path.

Type: OpenClaw Skill Name: xhs-to-obsidian Version: 1.0.0 The skill contains a security vulnerability in `scripts/extract_post.py` where SSL certificate verification is explicitly disabled (`ssl.CERT_NONE`), which facilitates potential Man-in-the-Middle (MITM) attacks during data extraction. Additionally, the skill requires users to manually export and provide sensitive session cookies as described in `SKILL.md`. While these behaviors are technically aligned with the stated goal of scraping authenticated content from Xiaohongshu, the intentional bypass of transport security and the handling of authentication tokens represent high-risk patterns.