Skills/ClawHub/redbook

redbook@0.8.2

VERIFIED· install only

Publisher claims: "Search, read, analyze, and automate Xiaohongshu (小红书) content via CLI" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher lucasygu · publishing for 63 daysInstalls 3,299Last detonated 7d ago
$clawhub install redbook
WatchReport an issue

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.
Tested
second launch with the clock 45 days ahead · every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-07 and scored it 85/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.1sprocessscript backend runs setup only
0.1sprocessscript backend runs setup only
0.1sprocesssecond launch, clock +45 days, CI unset
0.2sprocessexec /usr/bin/faketime

Static findings

MEDIUM
File type combined with upload actionscripts/postinstall.js:137 · File type combined with upload action — agent may exfiltrate local data filesconsole.log('[redbook] Running post-install...');Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionsrc/cli.ts:412 · File type combined with upload action — agent may exfiltrate local data filesif (opts.json) output(summary, true);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionsrc/cli.ts:486 · File type combined with upload action — agent may exfiltrate local data filesif (opts.json) output(result, true);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File permission modification commandpackage.json:24 · File permission modification command — agent changes file ownership/permissions"build": "tsc && chmod +x dist/cli.js",Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
LOW
Unpinned dependencySKILL.md:1207 · Unpinned dependency| "Request signature rejected (HTTP 406)" | XHS changed its web signing | Update redbook (`npm i -g @lucasygu/redbook@latest`); don't retry in a loop |Fix: Pin the exact version (`[email protected]`, `==1.2.3`) so every install gets the bytes that were reviewed.
AST06
MEDIUM
File type combined with upload actionsrc/cli.ts:386 · File type combined with upload action — agent may exfiltrate local data filesif (opts.json) output(data, true);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionSKILL.md:734 · File type combined with upload action — agent may exfiltrate local data files| `results/<id>.json` | Raw `--json` output for each processed item (the corpus) |Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionsrc/cli.ts:453 · File type combined with upload action — agent may exfiltrate local data filesif (opts.json) output(summary, true);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File permission modification commandCLAUDE.md:15 · File permission modification command — agent changes file ownership/permissions- `npm run build` — TypeScript compile + chmodFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
LOW
Unpinned dependencysrc/lib/client.ts:198 · Unpinned dependency"Request signature rejected (HTTP 406) — XHS may have changed its web signing. Update redbook: npm i -g @lucasygu/redbook@latest",Fix: Pin the exact version (`[email protected]`, `==1.2.3`) so every install gets the bytes that were reviewed.
AST06
MEDIUM
File type combined with upload actionsrc/cli.ts:468 · File type combined with upload action — agent may exfiltrate local data filesif (opts.json) output(summary, true);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07

Cost to the agent

Instructions loaded
≈15,632 tok
2 files · 29 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.