xiaohongshu-research-kit

Extract and analyze Xiaohongshu (Little Red Book) content using yt-dlp and gallery-dl. Supports note metadata, image/video extraction, user profile analysis,...

This skill appears to do what it claims: it guides using local yt-dlp and gallery-dl to extract Xiaohongshu notes and profiles. Before using it, ensure you: (1) run yt-dlp/gallery-dl locally from trusted installs (brew/pip) rather than executing untrusted bundles; (2) avoid pasting raw browser cookie strings into chats — prefer letting yt-dlp/gallery-dl read cookies locally (and only on a machine you control); (3) be aware that cookie access can expose authenticated session tokens, so do not run these commands on shared CI or untrusted hosts; (4) respect Xiaohongshu's terms of service and copyright when downloading or storing media. If you need stronger assurance, ask the publisher for the project repository code to audit or run the commands in an isolated VM/container.

Type: OpenClaw Skill Name: xiaohongshu-research-kit Version: 1.0.0 The skill is classified as suspicious due to potential shell injection vulnerabilities in SKILL.md, where the AI agent is instructed to construct and execute shell commands (yt-dlp and gallery-dl) using unvalidated user-provided inputs such as URLs and keywords. Furthermore, the instructions explicitly direct the agent to use the '--cookies-from-browser' flag, which grants access to sensitive browser session data. While these capabilities are functionally relevant to the stated purpose of Xiaohongshu research, the combination of high-privilege data access and the lack of input sanitization poses a significant security risk.