← 返回 Skills 市场
549
总下载
1
收藏
5
当前安装
1
版本数
在 OpenClaw 中安装
/install xiaohongshu-publish-skill
功能描述
Xiaohongshu (RedNote/小红书) automation skill for content publishing and engagement. Publish image-text notes via the xhs API using cookies, and simulate browse...
安全使用建议
What to consider before installing:
- The skill requires a full Xiaohongshu session cookie (XHS_COOKIE) stored in a .env file; this is sensitive and grants account-level actions (publish posts, comment). Only use with accounts you trust (consider a throwaway/test account).
- The registry metadata did NOT declare this required credential — that mismatch is a red flag. Ask the publisher/maintainer (or the registry) to update metadata to declare XHS_COOKIE as a required credential.
- The skill installs Python packages from PyPI (including an 'xhs' package) and downloads Chromium via Playwright. Review those package origins and versions if you are concerned about supply-chain risk.
- The skill will create and persist browser profile data under xhs_browser_data/ inside the skill directory. If you want isolation, run in a sandboxed VM or container and avoid storing cookies on shared systems.
- Read the included scripts (publish_xhs.py and interact_xhs.py) yourself (they are present and transparent). They do not contain hidden remote endpoints or obfuscated exfiltration code, but they perform network calls to Xiaohongshu and will use your cookie to act as your account.
- If you plan to proceed: (1) test with a non-production account; (2) rotate or revoke the cookie after use if you used a real account; (3) consider running the skill in an isolated environment; (4) ask the publisher to correct the registry metadata to list XHS_COOKIE as a required credential so the risk is visible up front.
功能分析
Type: OpenClaw Skill
Name: xiaohongshu-publish-skill
Version: 1.0.0
The skill bundle provides legitimate automation for Xiaohongshu (RedNote) publishing and interaction using the 'xhs' API library and Playwright for browser simulation. While it requires sensitive session cookies (XHS_COOKIE) stored in a .env file, the code (scripts/publish_xhs.py and scripts/interact_xhs.py) is transparent, well-documented, and lacks any indicators of data exfiltration, unauthorized remote execution, or malicious prompt injection. The functionality is strictly aligned with the stated purpose of content management and engagement on the platform.
能力评估
Purpose & Capability
The skill's name/description match the included Python scripts (publish_xhs.py and interact_xhs.py) and Playwright usage. However the registry metadata lists no required environment variables or primary credential, while SKILL.md and the code clearly require an XHS_COOKIE in a .env file for publishing. That metadata omission is an incoherence — the skill legitimately needs a sensitive cookie but does not declare it to the registry.
Instruction Scope
SKILL.md instructs the agent/operator to create a .env with XHS_COOKIE, to run setup.sh to create a venv and install dependencies, and to use xhs_browser_data/ for persistent browser login data. The instructions therefore direct the agent to read local files (.env, images), persist browser profile data under the skill directory, and perform network calls. Those actions are coherent with the stated purpose, but they reference sensitive local state (cookies, browser profile) that the metadata did not declare — a scope/visibility mismatch that should be clarified.
Install Mechanism
There is no automated install spec in the registry, but the package includes a setup.sh that creates a Python venv and runs pip install -r requirements.txt (xhs, playwright, python-dotenv, requests) and installs Playwright Chromium. Installing from PyPI and downloading browser binaries is expected for this skill but carries the usual supply-chain risk of third-party packages. No arbitrary remote archives or URL shorteners are used.
Credentials
Functionality requires a full XHS_COOKIE (including a1 and web_session) and a persistent browser profile directory; those are proportionate to publishing and webpage simulation. The problem is the skill metadata did not declare any required environment variables or primary credential despite the code depending on XHS_COOKIE. Requesting a long-lived session cookie is sensitive because it effectively grants full account access; the skill does not request unrelated credentials, but the missing declaration is concerning.
Persistence & Privilege
The skill does not set always: true and does not claim elevated platform privileges. It uses a persistent Playwright user_data_dir stored under the skill (xhs_browser_data/) to retain login sessions; this is normal for browser automation but implies persistent local profile data is created and reused.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install xiaohongshu-publish-skill - 安装完成后，直接呼叫该 Skill 的名称或使用
/xiaohongshu-publish-skill触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.0
xiaohongshu-publish-skill v1.0.0
- Initial release of the Xiaohongshu (小红书) publishing and engagement automation skill.
- Supports automated publishing of image-text notes via xhs API with cookie authentication.
- Enables simulated browser interactions (search, browse, comment) using Playwright.
- Detailed setup instructions, workflow guides, and troubleshooting references included.
- Provides sample scripts for publishing and engaging on Xiaohongshu.
元数据
常见问题
xiaohongshu-publish-skill 是什么？
Xiaohongshu (RedNote/小红书) automation skill for content publishing and engagement. Publish image-text notes via the xhs API using cookies, and simulate browse... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 549 次。
如何安装 xiaohongshu-publish-skill？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install xiaohongshu-publish-skill」即可一键安装，无需额外配置。
xiaohongshu-publish-skill 是免费的吗？
是的，xiaohongshu-publish-skill 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
xiaohongshu-publish-skill 支持哪些平台？
xiaohongshu-publish-skill 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 xiaohongshu-publish-skill？
由 BigHit1（@bighit1）开发并维护，当前版本 v1.0.0。
推荐 Skills