Xiaohongshu Mcp Node

通过 MCP 协议操作小红书平台，支持内容发布、搜索、互动等完整功能

This skill appears to do what it says (drive Xiaohongshu through an MCP server implemented with Node + Playwright), but you should take precautions before installing: 1) Inspect the GitHub repository and any install.sh script before running it — piping remote scripts to bash is risky. 2) Treat cookies.json as sensitive (it contains authentication). Store it with restrictive permissions (chmod 600), keep it local, and consider using a throwaway/test account. 3) Consider cloning and reviewing the code, or running the MCP server in an isolated VM/container rather than on a production machine. 4) Be aware of account‑risk: automation can trigger platform rate limits or bans. 5) If you must install, avoid curl|bash; download the repo and review scripts, then run npm install and npx playwright install chromium manually. If you want a stronger assurance, ask the author for a reproducible release (GitHub Releases tarball with checksums) or perform a security review of the repository before trusting it.

Type: OpenClaw Skill Name: xiaohongshu-mcp-node-skill Version: 0.1.0 The skill bundle provides documentation and configuration for an MCP server to automate Xiaohongshu (XHS) interactions, including content publishing, searching, and account management. It requires high-risk capabilities such as shell execution (via Node.js), network access, and local file system access for managing session cookies and media uploads. While these are plausibly needed for the stated purpose, the inclusion of a 'curl | bash' installation script in quick-start.md and the handling of sensitive session data (cookies.json) meet the threshold for a suspicious classification. No evidence of intentional malice, such as data exfiltration or unauthorized remote control, was found in the provided files (SKILL.md, quick-start.md, faq.md).