中文 EN

Scan Report

Scan New Files

This report was generated in Chinese. Some content may be in Chinese.
✓ Trusted — Risk Score 5/100
Last scan:3 hr ago Rescan
5 /100
xhs-skill-pusher
小红书内容发布技能 - 规范化cookie管理 + xhs-kit自动化发布
小红书内容发布技能，标准化Cookie管理和xhs-kit自动化发布，代码功能与文档一致，无恶意行为
Skill Namexhs-skill-pusher
Duration34.0s
Enginepi
ClawHub xhs-skill-pusher v1.0.0 by glittering
📥 172
ClawHub Verdict Suspicious dangerous_exec
✓
Safe to install
可安全使用。注意：pip安装时建议指定版本以避免供应链风险

Findings 1 items

Severity Finding Location
Low
Python依赖未指定版本锁定 Supply Chain
SKILL.md安装指南中使用pip install xhs-kit等命令，未指定具体版本，存在供应链风险
pip install xhs-kit
pip install pillow requests markdown pyyaml
→ 建议指定版本范围，如 pip install xhs-kit>=0.1.0,<1.0.0
 SKILL.md:42
ResourceDeclaredInferredStatusEvidence
Filesystem WRITE WRITE ✓ Aligned scripts/xhs_save_cookie.sh:150 - echo "$cookie_json" > "$filepath"
Shell WRITE WRITE ✓ Aligned scripts/xhs_final.sh:18 - source xhs-env/bin/activate; exec ./xhs_simple.sh
Network READ READ ✓ Aligned bin/xhs-pusher.mjs:44 - execSync('which xhs-kit')
1 findings
📧
Info Email 邮箱地址
[email protected]
PUSH_GUIDE.md:47

File Tree

12 files · 73.4 KB · 2815 lines
Shell 5f · 1308L Markdown 5f · 1097L JavaScript 1f · 373L JSON 1f · 37L
├─ ▾ 📁 bin
│ └─ 📜 xhs-pusher.mjs JavaScript 373L · 10.2 KB
├─ ▾ 📁 docs
│ ├─ 📝 QUICK_START.md Markdown 165L · 3.7 KB
│ └─ 📝 XHS_FINAL_SOLUTION.md Markdown 237L · 6.4 KB
├─ ▾ 📁 scripts
│ ├─ 🔧 xhs_final.sh Shell 19L · 515 B
│ ├─ 🔧 xhs_manage.sh Shell 474L · 14.2 KB
│ ├─ 🔧 xhs_save_cookie.sh Shell 310L · 7.4 KB
│ └─ 🔧 xhs_simple.sh Shell 453L · 11.3 KB
├─ 📋 package.json JSON 37L · 842 B
├─ 📝 PUSH_GUIDE.md Markdown 188L · 4.5 KB
├─ 🔧 push_to_github.sh Shell 52L · 1.4 KB
├─ 📝 README.md Markdown 168L · 4.5 KB
└─ 📝 SKILL.md Markdown 339L · 8.4 KB

Dependencies 4 items

PackageVersionSourceKnown VulnsNotes
xhs-kit * pip No 无版本锁定
playwright * pip No 无版本锁定
commander ^11.1.0 npm No 知名CLI库
chalk ^5.3.0 npm No 知名终端样式库

Security Positives

✓ 代码结构清晰，所有Shell操作均在脚本内部完成
✓ 功能与文档描述一致，无阴影功能
✓ Cookie仅存储在本地xhs_cookies目录，无外传行为
✓ 使用标准化xhs-kit库，无自定义恶意代码
✓ Node.js依赖来自npm官方仓库（commander, chalk等知名库）