📦 xiaohongshu-search — 小红书搜索
v1.0.0已登录 Chrome 浏览器自动搜索小红书公开笔记，一键提取标题、正文、话题标签与点赞数，快速洞察消费趋势，为市场调研提供数据支持。
1· 200·1 当前·1 累计
by 下载技能包
最后更新
2026/3/24
安全扫描
OpenClaw
可疑
medium confidenceThe skill's described purpose (search and scrape Xiaohongshu public notes) matches its runtime instructions, but it relies on controlling a logged-in Chrome via remote debugging—a capability that can access unrelated private session data and is not declared in the manifest, so proceed with caution.
评估建议
This skill does what it says (search and scrape Xiaohongshu) but requires Chrome to be started with remote debugging and assumes a logged-in browser profile. That arrangement can expose cookies and other private session data to the agent. Before installing or running: (1) avoid pointing the skill at a Chrome instance that is logged into your real accounts — use a throwaway profile or dedicated browser profile. (2) Launch Chrome with remote debugging bound to localhost only and firewall/block net...详细分析 ▾
ℹ 用途与能力
The name and description match the instructions: the SKILL.md tells the agent to drive a browser to search Xiaohongshu and extract titles, content, tags, and likes. However, the skill depends on an already logged-in Chrome instance with remote debugging enabled (documented only in SKILL.md), which is a broad capability beyond a simple public-search scraper and is not declared as a requirement in the registry metadata.
⚠ 指令范围
Instructions explicitly require connecting to Chrome's remote debugging endpoint and driving the browser to load pages and evaluate DOM scripts. While scraping public pages is within scope, controlling a logged-in Chrome gives access to cookies, other sites, and private account data — the SKILL.md does not constrain or limit this, so the runtime instructions could be used to read or exfiltrate data beyond the stated purpose.
✓ 安装机制
No install spec and no code files are present (instruction-only skill). This minimizes disk-write/installation risk; there are no external downloads or package installs to review.
⚠ 凭证需求
No environment variables or credentials are declared, which is coherent. However, the skill requires Chrome to be launched with --remote-debugging-port, which effectively grants the skill access to the browser profile and session information (cookies, stored auth). That capability is high-impact relative to the simple scraping task and is not surfaced as a credential or config requirement in the manifest.
ℹ 持久化与权限
always is false and there are no persistent config changes requested. The skill can be invoked autonomously (default), and combined with browser control this increases the potential blast radius if the agent runs without supervision — this is expected behavior for skills but worth noting as a risk factor here.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/24
- Initial release of xiaohongshu-search: a tool to search and analyze open content from Xiaohongshu via a browser with remote debugging. - Supports extracting note titles, links, author nicknames, like counts, and main content for trend and market research. - Provides step-by-step instructions for searching, content extraction, and analysis of consumer trends. - Includes usage examples and output formats suitable for integration into business research reports.
● 无害
安装命令
点击复制官方npx clawhub@latest install xiaohongshu-search
镜像加速npx clawhub@latest install xiaohongshu-search --registry https://cn.longxiaskill.com