中文 EN

Scan Report

Scan New Files

✓ Trusted — Risk Score 0/100
Last scan:20 hr ago Rescan
0 /100
xiaohongshu-creator-finder
小红书AI创作者识别 - 在小红书平台按预设规则自动搜索并识别AI原创动画创作者
A legitimate Xiaohongshu (Little Red Book) creator scraping tool that uses Playwright to browse, login via QR code, search for AI creators by keywords, scrape public profile data, and export to Excel/JSON. No malicious behavior observed.
Skill Namexiaohongshu-creator-finder
Duration35.5s
Enginepi
✓
Safe to install
No action needed. The skill is a standard web scraper for Xiaohongshu platform data. Consider pinning dependency versions for reproducibility.

Findings 2 items

Severity Finding Location
Low
Dependencies use loose version specifiers Supply Chain
requirements.txt and skill.json specify '>=X.Y.Z' rather than exact pinned versions (e.g., 'playwright==1.40.0'). This allows supply chain substitution attacks if a malicious higher version is published.
playwright>=1.40.0
→ Pin exact versions: playwright==1.40.0, pandas==2.0.0, openpyxl==3.1.0
 docs/requirements.txt:1
Low
Cookies stored in plaintext JSON file Credential Theft
Xiaohongshu authentication cookies (including id_token and web_session) are stored in plain text at config/cookies.json. While this is necessary for login persistence, the file contains sensitive session tokens.
web_session, id_token stored in plaintext
→ This is functional requirement for the scraper but poses risk if the workspace is compromised. Consider warning users to keep the workspace secure.
 config/cookies.json:1
ResourceDeclaredInferredStatusEvidence
Network READ READ ✓ Aligned SKILL.md declares browsing capability
Filesystem WRITE WRITE ✓ Aligned config/settings.json, output checkpoint/result files in src/xhs_creator_finder.p…
Shell NONE NONE — No subprocess or shell calls found
Environment NONE NONE — No os.environ access found
Clipboard NONE NONE — No clipboard access found
Browser READ READ ✓ Aligned Playwright chromium.launch in src/xhs_creator_finder.py:177
Database NONE NONE — No database access found
Skill Invoke NONE NONE — No skill invocation found
7 findings
🔗
Medium External URL 外部 URL
https://www.xiaohongshu.com/user/profile/...
docs/使用说明书.md:176
🔗
Medium External URL 外部 URL
https://www.xiaohongshu.com/explore/...
docs/使用说明书.md:178
🔗
Medium External URL 外部 URL
https://www.xiaohongshu.com/user/profile
src/xhs_creator_finder.py:192
🔗
Medium External URL 外部 URL
https://www.xiaohongshu.com/login
src/xhs_creator_finder.py:197
🔗
Medium External URL 外部 URL
https://www.xiaohongshu.com/search_result?keyword=
src/xhs_creator_finder.py:229
🔗
Medium External URL 外部 URL
https://www.xiaohongshu.com
src/xhs_creator_finder.py:249
🔗
Medium External URL 外部 URL
https://www.xiaohongshu.com/user/profile/
src/xhs_creator_finder.py:326

File Tree

12 files · 41.8 KB · 1437 lines
Markdown 5f · 721L Python 2f · 458L JSON 4f · 255L Text 1f · 3L
├─ ▾ 📁 config
│ ├─ 📋 config.example.json JSON 10L · 226 B
│ ├─ 📋 cookies.json JSON 151L · 3.7 KB
│ └─ 📋 settings.json JSON 10L · 282 B
├─ ▾ 📁 docs
│ ├─ 📝 README.md Markdown 120L · 3.1 KB
│ ├─ 📄 requirements.txt Text 3L · 49 B
│ ├─ 📝 SKILL.md Markdown 110L · 2.8 KB
│ ├─ 📝 STATUS.md Markdown 63L · 1.7 KB
│ └─ 📝 使用说明书.md Markdown 318L · 7.7 KB
├─ ▾ 📁 src
│ └─ 🐍 xhs_creator_finder.py Python 436L · 17.1 KB
├─ 📋 skill.json JSON 84L · 2.0 KB
├─ 📝 SKILL.md Markdown 110L · 2.8 KB
└─ 🐍 skill.py Python 22L · 469 B

Dependencies 3 items

PackageVersionSourceKnown VulnsNotes
playwright >=1.40.0 pip No Version not pinned, loose specifier
pandas >=2.0.0 pip No Version not pinned, loose specifier
openpyxl >=3.1.0 pip No Version not pinned, loose specifier

Security Positives

✓ No shell command execution (subprocess, os.system, etc.) - only Playwright browser automation
✓ No obfuscated code, base64 payloads, or eval() calls
✓ No access to sensitive local paths (~/.ssh, ~/.aws, .env, etc.)
✓ No data exfiltration - all network activity is to/from Xiaohongshu.com only
✓ No remote script execution (curl|bash, wget|sh)
✓ No credential harvesting beyond what is required for the Xiaohongshu login
✓ No persistence mechanisms (no cron jobs, startup hooks, or backdoors)
✓ No hidden functionality - SKILL.md accurately describes the tool's behavior
✓ Dependencies (playwright, pandas, openpyxl) have no known vulnerabilities
✓ Code is clean, readable, and well-documented with no suspicious patterns