Skills/ClawHub/xiaohongshu-opportunity-research

xiaohongshu-opportunity-research@1.1.4

VERIFIED

Publisher claims: "研究小红书搜索结果、作品结构、达人数据和用户反馈，筛选值得继续验证的机会。当用户询问小红书选题、小红书增长或用户痛点时使用。支持四大能力：(1) 关键词搜索笔记/视频，可按点赞数、评论数、收藏数、发布时间、内容类型筛选排序；(2) 博主作品抓取，按主页链接获取博主的互动数据（粉丝量、点赞量或收藏量等）或公开作品列表；(3) 笔记（视频）详情，获取详情数据及互动数据等，分析笔记的市场表现；(4) 笔记评论分析，按笔记链接获取评论内容与互动数据。用户提到小红书/xhs/rednote 且需要查数据、市场调研、做选题、竞品监控、KOL筛选、舆情分析时调用；无需登录账号" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher why20261 · joined 14 days agoInstalls 280Last detonated 4 h ago
$clawhub install xiaohongshu-opportunity-research
WatchReport an issue

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-11-05 and scored it 87/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only

Static findings

MEDIUM
File type combined with upload actionsrc/xiaohongshu/comment-cli.js:182 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionsrc/xiaohongshu/post-cli.js:162 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionsrc/xiaohongshu/detail-cli.js:143 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionsrc/xiaohongshu/search-cli.js:202 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07

Cost to the agent

Not measured yet; benchmarks are collected with each run since November 5, 2026. See the MCP server benchmarks.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

xiaohongshu-opportunity-research@1.1.4 safety verdict: Verified 87/100 — KillerSkills