📦 Xhs Autopilot — 小红书全自动运营
v1.0.130分钟自进化闭环，AI驱动的小红书账号全自动内容生成、发布与数据优化，一键托管涨粉。
0· 189·0 当前·0 累计
by 下载技能包
最后更新
2026/4/21
安全扫描
OpenClaw
可疑
medium confidenceNULL
评估建议
This skill is functionally coherent for automating Xiaohongshu activity, but it has several red flags: (1) the package does NOT include the scripts it tells the agent to run — ask the author or expect the agent to look elsewhere for code, which is risky; (2) it relies on connecting to your local Chrome CDP (localhost:9222) to inherit login state — that gives the agent the ability to act as you on Xiaohongshu; (3) it will read and write local memory directories and may publish automatically every...详细分析 ▾
⚠ 用途与能力
The SKILL.md describes a Xiaohongshu full‑autonomous workflow and references many local scripts (scripts/*) and memory directories (xhs-memory/). That capability (automated publishing using an existing logged‑in Chrome) is internally coherent with the described purpose. However, the skill bundle does NOT include the referenced scripts or an install spec that would provide them. Expecting to run scripts that are absent is an incoherence: the skill assumes a larger codebase and local state that are not provided by this package, which could lead the agent to search, download, or execute unexpected code.
⚠ 指令范围
The runtime instructions direct the agent to access local files and directories (xhs-memory/, workspace/MEMORY.md, performance_data/), connect to a local Chrome CDP on localhost:9222 (to inherit user's login/session), take screenshots, scrape likes/comments, spawn sub-agents, and run/execute local scripts (python3 scripts/autopilot/run.sh, etc.). These actions access sensitive local state (browser cookies, logged-in session) and could autonomously publish content. Those actions are relevant to the stated purpose but are broad and invasive for an instruction-only skill with no embedded code or provenance.
✓ 安装机制
There is no install specification (instruction-only skill), so nothing is written or downloaded by the skill bundle itself. This is low risk from an install vector perspective, but it means the agent will attempt to run local scripts or rely on the user's environment to provide missing components.
⚠ 凭证需求
The skill declares no required env vars, but the instructions implicitly require: an accessible Chrome CDP at localhost:9222, an active Xiaohongshu login in that browser, and writable local memory directories. Access to a user's browser session and local files is sensitive and should be explicitly declared — the omission reduces transparency and is disproportionate without clear provenance or included scripts.
ℹ 持久化与权限
always:false (default) and model invocation is allowed (default). The skill describes an autonomous 30‑minute loop and persistent memory files under xhs-memory/; while it does not force inclusion via always:true, autonomous operation combined with access to a logged-in browser/session increases the practical blast radius. The skill does not request system-wide config changes or other skills' credentials.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.12026/3/18
NULL
● 可疑
安装命令
点击复制官方npx clawhub@latest install xhs-autopilot
镜像加速npx clawhub@latest install xhs-autopilot --registry https://cn.longxiaskill.com