by 安全扫描
OpenClaw
安全
medium confidenceThe skill's requests and runtime instructions are coherent with a XiaoHongShu automation skill that talks to a local MCP service, but it relies on running third‑party Node code you should review before installing.
评估建议
This skill is internally consistent with its stated purpose, but it depends on running a third‑party Node service from https://github.com/weznai/xhs-mcp-service.git. Before installing or running it: (1) review the repository (especially package.json and npm scripts) to see what npm install / npm run login execute; (2) run the service in an isolated environment (container/VM) if you don't fully trust the code; (3) be aware the service will hold session cookies/tokens and can post/modify content o...详细分析 ▾
✓ 用途与能力
The name/description (XHS automation via MCP) matches the instructions: it expects a local xhs-mcp-service on localhost:18060 and Node.js >= 18 to provide the automation endpoints. No unrelated credentials, binaries, or config paths are requested.
ℹ 指令范围
SKILL.md limits runtime activity to installing and running the referenced xhs-mcp-service and calling its APIs (e.g., searchFeeds, likeFeed). It does not instruct reading arbitrary system files or unrelated environment variables, but it does require performing a 'login' step and will interact with account session tokens (cookies/xsec_token) — expected for this functionality.
⚠ 安装机制
There is no packaged install; the README instructs to git clone a third-party GitHub repo and run npm install / npm run login / npm start. While GitHub is a normal source, running npm install and npm scripts executes external code (moderate risk). The skill bundle itself doesn't include the code, so you must review that repository and its npm scripts before running.
✓ 凭证需求
The skill declares no required environment variables or external credentials. The need for a local service and session tokens is proportional to the described automation and publishing features.
✓ 持久化与权限
always is false and the skill does not request system-wide changes or other skills' configuration. Autonomous invocation is allowed by default (normal); remember that if the agent is allowed to act autonomously, it could drive the local service to perform account actions.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/15
Initial release of skill-xhs-mcp-oper: - Provides automation for XiaoHongShu (RED/XHS) via local MCP service. - Includes 13 tools for login, content management, interactions, and publishing. - Supports actions like login management, content search, browsing, publishing (images/videos), and social interactions (like, favorite, comment). - Requires Node.js ≥18 and local xhs-mcp-service running.
● 无害
安装命令 点击复制
官方npx clawhub@latest install skill-xhs-mcp
镜像加速npx clawhub@latest install skill-xhs-mcp --registry https://cn.clawhub-mirror.com
技能文档
XiaoHongShu automation skill via MCP protocol.
Features
- 13 complete tools
- Login management
- Content search and browsing
- Social interactions (like, favorite, comment)
- Content publishing (images and videos)
Requirements
- Node.js >= 18
- xhs-mcp-service running on localhost:18060
Installation
git clone https://github.com/weznai/xhs-mcp-service.git
cd xhs-mcp-service
npm install
npm run login
npm start
Tools
- check_login_status - Check login status
- get_login_qrcode - Get login QR code
- delete_cookies - Delete login state
- list_feeds - Get home feed
- search_feeds - Search notes
- get_feed_detail - Get note details
- like_feed - Like/unlike note
- favorite_feed - Favorite/unfavorite note
- post_comment_to_feed - Post comment
- reply_comment_in_feed - Reply to comment
- user_profile - Get user profile
- publish_content - Publish image note
- publish_with_video - Publish video note
Usage
import { searchFeeds, likeFeed } from './src/xhs-tools.js';const results = await searchFeeds('coffee');
await likeFeed(results.feeds[0].id, results.feeds[0].xsec_token);
License
MIT
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制