ljh-xhs@1.0.0
VERIFIED· install onlyPublisher claims: "小红书图文爆款拆解器。拿到一条小红书图文样本，先判断样本等级（能不能拆），再按用户链路拆封面、图文承接、爆款因子、成立机制、变量分层，最后给出受控变体迁移方案。 触发方式：/ljh-xhs、「帮我拆一条小红书爆款」「这条图文笔记为什么能卖」「小红书图文怎么复刻」「这张封面为什么点击高」 Xiaohongshu (RED) viral image-text post decomposer. Given a sample post, judge whether it is even decomposable, then break down cover, page 2-5 handoff, viral factors and mechanism, variable layering, and produce a controlled-variant migration plan. Trigger: /ljh-xhs, "break down this Xiaohongshu viral post", "why does this post convert", "how do I replicate this RED post" 不要在拆解抖音视频、公众号文章等非小红书图文场景自动触发。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Coverage
Nothing executable in the bundle ran; the trace covers the install step only.- Tested
- every file read, file written and host contacted by what ran
- Not tested
- use of the skill by an agent
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-09 and scored it 93/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationsStatic findings
No findings across 470 lines in 2 files.
Cost to the agent
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.