by 下载技能包
最后更新
2026/4/13
安全扫描
OpenClaw
安全
medium confidence该技能的代码与运行时指令与其声明目的（抓取小红书并生成多模态摘要）一致，但需在运行时执行动态 npm/playwright 代码，并指示智能体读取本地图片文件——这两点均需用户留意。
评估建议
This skill appears to do what it claims, but consider these points before installing/ running it:
- Runtime npm fetch: run.sh uses npx @playwright/cli which may download and execute code from npm at runtime. If you prefer, preinstall Playwright (npm install -g @playwright/cli or your platform package) to avoid dynamic downloads.
- File access: the agent is instructed to read and 'see' image files saved in OUTPUT_DIRECTORY. Only run this skill in an environment where the agent is allowed to read ...详细分析 ▾
✓ 用途与能力
Name/description match the files and instructions: a Playwright-based scraper (run.sh) collects posts and parse.py downloads images and writes raw markdown for synthesis. The declared dependencies in SKILL.md (playwright-cli, python3, requests) are what the code actually uses.
ℹ 指令范围
SKILL.md explicitly requires the agent to read the generated markdown and to open/interpret the image files on disk with its vision capabilities. That is consistent with the synthesizer purpose, but it means the agent will access local files (the OUTPUT_DIRECTORY) and must be permitted to read binary images. The instructions also tell the agent to embed images into the final report — which is expected but important to note for privacy.
ℹ 安装机制
There is no formal install spec in the registry, but run.sh invokes npx @playwright/cli run-code which will fetch and run code from npm if playwright isn't present. Using npx/Playwright is reasonable for a scraper but carries the usual runtime supply-chain risk of fetching npm packages dynamically.
✓ 凭证需求
The skill does not request unrelated environment variables or secrets. It only uses environment variables for keyword and max posts (exported by run.sh). parse.py uses no credentials and restricts downloaded image URLs to specified Xiaohongshu domains (HTTPS).
✓ 持久化与权限
always is false and the skill only creates files under the user-specified OUTPUT_DIRECTORY and a temporary /tmp script. It does not modify other skills' configs or request persistent system privileges.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.32026/4/13
- 更新技能名称与描述，明确 Xiaohongshu 搜索与摘要能力。 - 详述两阶段流程：先以 Playwright 与 Python 自动提取数据，再由 AI 整合文本与图片生成摘要。 - 新增严格使用与报告规范，要求深度分析文本、评论及图片内容，并输出主题式综合报告。 - 明确依赖（`playwright-cli`、`python3`、`requests`）及错误处理，特别针对登录受阻场景。 - 提供提取脚本运行与最终报告编译的逐步指引。
● 无害
安装命令
点击复制官方npx clawhub@latest install xhs-search-summarizer-seckho
镜像加速npx clawhub@latest install xhs-search-summarizer-seckho --registry https://cn.longxiaskill.com