小红书笔记搬运

小红书笔记搬运到 Facebook 和 WordPress 的自动化流程。当用户要求搬运小红书笔记、发布小红书内容到 Facebook/WordPress 时使用。

This skill appears to implement the advertised task, but review before use: 1) The WordPress publish script reads WP_TOKEN from the environment though the skill metadata doesn't declare any required credentials — do not provide secrets until you verify the destination and token scope. 2) Ensure your environment has curl, python3, Pillow (PIL) and requests installed; the package doesn't declare these dependencies. 3) The skill uses osascript to control macOS file dialogs — macOS will ask for automation/accessibility permission; only grant this if you trust the code and author. 4) The scripts reference specific account IDs and save paths (~/Downloads/铁头/... and /tmp/openclaw/uploads/) — check/adjust paths and do a dry run in an isolated environment. 5) Because the skill includes runnable scripts and network calls, inspect the code yourself (or run in a sandbox) before giving it access to your credentials or broad filesystem permissions.

Type: OpenClaw Skill Name: xiaohongshu-transfer Version: 1.0.0 The skill bundle automates content scraping from Xiaohongshu and cross-posting to Facebook and WordPress. It employs high-risk capabilities, specifically using `osascript` (documented in `SKILL.md` and `references/platforms.md`) to programmatically control the macOS system UI (`com.apple.appkit.xpc.openAndSavePanelService`) to automate file upload dialogs. Additionally, `scripts/download_images.sh` uses potentially dangerous shell commands (`rm -rf`) on a temporary directory. While these behaviors are aligned with the stated automation goals, the use of system-level UI manipulation and broad file system operations represents a significant attack surface in an agentic environment.