小红书登录

小红书 MCP 登录流程。当用户需要登录小红书、小红书登录过期、或需要获取小红书登录二维码时使用此 skill。

Before installing/using this skill, verify the execution environment and confirm assumptions: (1) Ensure mcporter is available and authenticated in your environment — the skill relies on mcporter calls. (2) The SKILL.md expects Node.js (child_process.execSync) and a local 'read' tool; the skill metadata does not declare these — provide or adapt them or request the author to declare requirements. (3) Replace the hard-coded path (/Users/chen/.openclaw/workspace/xhs_login.png) with a workspace-relative or configurable path to avoid overwriting someone else's files. (4) The instructions include sending the image to Feishu but declare no Feishu credentials; confirm how authentication is handled and whether sending images externally is acceptable. (5) The Node snippet uses shell exec and a regex to extract base64 — this is brittle and can mis-parse output or be abused; prefer structured output or safer parsing if possible. (6) If you must use the skill, run it in a controlled environment with limited permissions and review the exact commands it will run. Ask the skill author to (a) declare required runtimes/tools and credentials, (b) avoid hard-coded paths, and (c) avoid shelling untrusted output without sanitization. If these clarifications are not provided, treat the skill as risky to use with sensitive accounts or on a personal machine.

Type: OpenClaw Skill Name: xiaohongshu-login Version: 1.0.0 The skill is classified as suspicious due to the hardcoded absolute path `/Users/chen/.openclaw/workspace/xhs_login.png` used for saving, displaying, and sending the QR code image in `SKILL.md`. While the intent is to save a temporary image for a legitimate login flow, hardcoding an absolute path to a specific user's home directory is a significant vulnerability and bad practice. It introduces portability issues and could lead to file system errors or, in specific environments, potential information leakage or overwrite if the path were to resolve to a sensitive location or be manipulated via symlinks. There is no evidence of intentional malicious behavior like data exfiltration or backdoors.