xiaohongshu-matrix-manager

小红书矩阵系统 API 调用工具，集成红薯矩阵平台（hongshujuzhen.com）。支持：搜索小红书笔记、获取笔记详情、发布图文笔记、查询账号列表、查询 API 使用统计、批量管理小红书账号。触发词：小红书、xhs、笔记搜索、发布小红书、API 调用、红薯矩阵。

Before installing, consider the following: - The skill documentation requires an API key for redapi.cn but the skill metadata does not declare any required credential — ask the publisher to add a declared primaryEnv (e.g., REDAPI_API_KEY) so you know where and how the key will be supplied. - The SKILL.md instructs the agent to run Python via exec. Running arbitrary exec'd code can do much more than HTTP requests; prefer a skill that uses a constrained HTTP client call rather than executing arbitrary scripts. - The API examples use plain HTTP (http://redapi.cn). That will expose your API key and data in transit. Do not supply sensitive credentials unless you confirm the service supports HTTPS and you trust the endpoint. - Verify the legitimacy of hongshujuzhen/redapi.cn independently (official site, TLS, privacy policy). If you proceed, test in a sandbox account with a low‑privilege API key first. - Ask the publisher for clarifications: (1) a declared env var name for the API key, (2) explicit guidance on required runtimes (python/requests) or a non-exec HTTP implementation, and (3) confirmation that HTTPS is supported. If they cannot or will not provide those, treat the skill as higher risk.

Type: OpenClaw Skill Name: xhsmatrixmanager Version: 1.0.0 The skill provides an interface for a third-party Xiaohongshu (XHS) management platform using the domain redapi.cn. While the functionality aligns with its stated purpose, it is classified as suspicious due to the use of unencrypted HTTP for API calls involving sensitive authentication keys (X-API-Key), which is a significant security vulnerability. The skill relies on the agent executing Python code via the 'exec' tool to perform network requests, which is a high-risk capability, though no evidence of intentional malice or data exfiltration was found in SKILL.md or references/api.md.