by 下载技能包
最后更新
2026/4/4
安全扫描
OpenClaw
安全
high confidenceNULL
评估建议
This skill appears to do what it claims: it automates Xiaohongshu by driving your real browser and account via a local WebSocket bridge and a Chrome extension. Before installing or using it, consider the following:
- Inspect the extension source (extension/*.js and manifest.json) before loading it into Chrome. Loading it grants the extension permissions to access site data on xiaohongshu domains, read cookies for that domain, capture screenshots, and use the Chrome debugger API.
- The debugger ...详细分析 ▾
✓ 用途与能力
Name/description (XHS automation: login, publish, search, interact) match the files and runtime instructions. Required binaries (python3, uv) and the presence of a CLI, bridge server, extension, and many xhs/ modules are appropriate and expected for this functionality.
ℹ 指令范围
SKILL.md explicitly restricts the agent to use this project's CLI (python scripts/cli.py) and describes required flows (login check, absolute file paths, user confirmation for publish/comment). Those instructions reference local files, starting Chrome, and the local bridge — all consistent with a local browser-automation workflow. Note: the extension + bridge allow reading cookies, running JS in the page's MAIN world, capturing screenshots, and uploading local files; these are required for the stated capabilities but have privacy implications.
✓ 安装机制
No automatic install spec; the README directs manual download/clone and manual loading of the extension. That is lower risk than an automated remote download/install. The project depends on installing Python packages via 'uv', which is consistent with pyproject.toml.
ℹ 凭证需求
The skill requests no environment variables or external credentials, which is proportionate. However, the Chrome extension requests permissions that expose browser state (cookies, host access to xiaohongshu domains, and the 'debugger' permission). These permissions are necessary for working with the user's logged-in browser and for setting file inputs via CDP, but they are powerful — installing the extension gives it access to site cookies and the ability to use Chrome's debugging APIs.
✓ 持久化与权限
always:false and normal autonomous invocation. The skill does not request permanent platform-level inclusion. It does require the user to install a browser extension and run a local bridge server; those components remain present on the user's machine only if the user installs/runs them.
安全有层次，运行前请审查代码。
运行时依赖
🖥️ OSmacOS · Linux
版本
latestv1.0.02026/4/4
NULL
● Pending
安装命令
点击复制官方npx clawhub@latest install xhs-skills
镜像加速npx clawhub@latest install xhs-skills --registry https://cn.longxiaskill.com