Skills xiaohongshu-search

📦

xiaohongshu-search

Name: xiaohongshu-search
Author: um-why

Content revision r1 High Risk ⚙️ External commands🌐 Network access📁 Filesystem access🔑 Env variables

Search Xiaohongshu Posts for Market Research

Xiaohongshu research is slow when teams inspect posts manually. This skill searches public notes, sorts results, and returns structured outputs for review.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "xiaohongshu-search" from https://skillstore.io/skills/um-why-xiaohongshu-search.md and its manifest at https://skillstore.io/api/skills/um-why-xiaohongshu-search/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/um-why-xiaohongshu-search.md Signed manifest GET /api/skills/um-why-xiaohongshu-search/manifest Signed lockfile GET /api/skills/um-why-xiaohongshu-search/lockfile

Test it

Using "xiaohongshu-search". Search for "camping gear" with 10 results.

Expected outcome:

Returns a success message, the searched keyword, total result count, post titles, author names, links, and engagement counts.

Using "xiaohongshu-search". Return Markdown results for "AI tutorial" sorted by likes.

Expected outcome:

Produces a readable list of matching posts with publish time, note link, author, likes, comments, saves, and shares.

Using "xiaohongshu-search". Search a competitor brand and review result themes.

Expected outcome:

Provides public result links and engagement metrics that an analyst can summarize into themes and content opportunities.

Security Audit

High Risk

v5 • 7/7/2026 Open versioned report

Most shell execution and obfuscation alerts are false positives from JavaScript template literals, ANSI escape codes, Markdown examples, and Chinese text. Confirmed issues are the external API dependency, token handling through environment or default credentials, and persistent local result caching. No prompt injection evidence was found in the reviewed files.

Files scanned

734

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (5)

High

scripts/search.js:119

Environment file access

const token = key.apiKey(process.env.GUAIKEI_API_TOKEN);

The flagged line reads GUAIKEI_API_TOKEN, which is then used in outbound API requests. The pattern is not an environment file read, but it is sensitive credential handling.

High

lib/key.js:18

[HEURISTIC] Very high entropy string (5.59 bits) - likely encoded/encrypted payload

未正确设置 GUAIKEI_API_TOKEN 环境变量, 将使用默认值, 可能影响搜索效率或搜索频率受限, 建议升级为私有TOKEN以获得更好的搜索体验

The surrounding token module returns a bundled default API token when GUAIKEI_API_TOKEN is absent. A shared embedded credential is a real security and abuse risk.

High

lib/key.js:16-20

Bundled Default API Token

The token helper returns a hardcoded default token when GUAIKEI_API_TOKEN is missing. Shared fallback credentials can be abused and make API usage hard to attribute.

The fallback branch directly returns a 32-character token string after warning the user. The behavior is explicit in the token management module.

High

scripts/search.js:119 lib/xiaohongshu.js:141-152 lib/xiaohongshu.js:239-250

API Token Sent In URL Query Parameters

The API token is placed into query parameters for task creation and result lookup. Query strings are often logged by clients, proxies, and services.

The script reads GUAIKEI_API_TOKEN and both request builders include token in querystring parameters. This is direct evidence of credential exposure through URLs.

Medium

scripts/search.js:208-210

Search Results Persisted Locally

The command writes the latest complete result object to scripts/last-search.json. This can retain user keywords, Xiaohongshu links, and returned profile metadata after the command finishes.

The final output object contains keyword, result links, metrics, and metadata, then writeFileSync saves it locally. The code has no opt-out or retention setting.

Capability review items (8)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

lib/xiaohongshu.js:159

HTTP/HTTPS request

const req = https.request(options, (res) => {

The code makes HTTPS requests to the external Guaikei service and includes user keywords and token-derived parameters. This is expected functionality but still transfers data outside the local environment.

Medium

lib/xiaohongshu.js:257

HTTP/HTTPS request

const req = https.request(options, (res) => {

Medium

lib/xiaohongshu.js:159

HTTP client library

const req = https.request(options, (res) => {

Medium

lib/xiaohongshu.js:257

HTTP client library

const req = https.request(options, (res) => {

Medium

scripts/search.js:210

Node.js fs operations

fs.writeFileSync(outputPath, JSON.stringify(finalOutput, null, 2));

The script writes the full final search output to scripts/last-search.json. This can persist user keywords, result links, and returned metadata without a retention control.

Medium

scripts/search.js:210

Synchronous file operations

fs.writeFileSync(outputPath, JSON.stringify(finalOutput, null, 2));

The script writes the full final search output to scripts/last-search.json. This can persist user keywords, result links, and returned metadata without a retention control.

Medium

scripts/search.js:119

Environment variable access (dot notation)

const token = key.apiKey(process.env.GUAIKEI_API_TOKEN);

The command reads GUAIKEI_API_TOKEN from process.env and passes it into external API calls. Accessing a secret-bearing environment variable is security relevant.

Medium

scripts/search.js:119

Environment variable object

const token = key.apiKey(process.env.GUAIKEI_API_TOKEN);

The command reads GUAIKEI_API_TOKEN from process.env and passes it into external API calls. Accessing a secret-bearing environment variable is security relevant.

Risk Factors

⚙️ External commands (58)

🌐 Network access (9)

lib/xiaohongshu.js:159 lib/xiaohongshu.js:257 lib/xiaohongshu.js:159 lib/xiaohongshu.js:257 lib/xiaohongshu.js:271 lib/xiaohongshu.js:278 package.json:16 package.json:18 package.json:22

📁 Filesystem access (15)

lib/xiaohongshu.js:84 scripts/search.js:40 scripts/search.js:113 scripts/search.js:117 scripts/search.js:161 scripts/search.js:210 scripts/search.js:39 scripts/search.js:107 scripts/search.js:108 scripts/search.js:160 scripts/search.js:117 scripts/search.js:210 scripts/search.js:3 scripts/search.js:4 scripts/search.js:5

🔑 Env variables (2)

scripts/search.js:119 scripts/search.js:119

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/um-why-xiaohongshu-search/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/um-why-xiaohongshu-search/security.svg)](https://skillstore.io/skills/um-why-xiaohongshu-search?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/um-why-xiaohongshu-search?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/um-why-xiaohongshu-search/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/um-why-xiaohongshu-search.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

um-why. (2026). xiaohongshu-search security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/um-why-xiaohongshu-search/audits/5

BibTeX citation

@techreport{um-why-um-why-xiaohongshu-search-2026,
  author = {um-why},
  title = {xiaohongshu-search security audit report (audit version 5)},
  institution = {Skillstore},
  year = {2026},
  number = {5},
  url = {https://skillstore.io/skills/um-why-xiaohongshu-search/audits/5},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "xiaohongshu-search security audit report (audit version 5)"
version: "unspecified"
type: report
authors:
  - name: "um-why"
date-released: "2026-07-07"
url: "https://skillstore.io/skills/um-why-xiaohongshu-search/audits/5"
identifiers:
  - type: other
    value: "skillstore:um-why-xiaohongshu-search:audit:5"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Find Content Angles

Search a topic and review recent high-engagement posts before planning new Xiaohongshu content.

Monitor Competitor Topics

Search competitor brand names and compare public post themes, links, and engagement signals.

Collect Research Samples

Export a controlled set of public search results for manual coding and campaign research.

Try These Prompts

Basic Keyword Search

Search Xiaohongshu for "camping gear" and return 10 results in JSON format.

Markdown Topic Scan

Search Xiaohongshu for "spring outfits" and return 15 results in Markdown format.

Engagement-Sorted Review

Search Xiaohongshu for "AI tutorial", show image-text posts, sort by most likes, and limit results to 20.

Competitive Research Batch

Search Xiaohongshu for three competitor brand names. Compare topics, engagement counts, post links, and visible author patterns.

Best Practices

Use specific keywords between 2 and 50 characters.
Set a private GUAIKEI_API_TOKEN before running production searches.
Review platform terms before collecting or storing social media data.

Avoid

Do not enter private customer data as search keywords.
Do not treat engagement counts as verified audience quality scores.
Do not rely on the bundled default token for repeated business use.

Frequently Asked Questions

Does this skill scrape Xiaohongshu directly?

No. The code calls the Guaikei API and formats the returned Xiaohongshu public result data.

Is an API token required?

Yes. A private GUAIKEI_API_TOKEN is recommended for reliable searches and clearer usage control.

What output formats are supported?

The command supports JSON for structured processing and Markdown for human review.

Can it analyze KOL authenticity?

No. The implemented code returns search results and visible metrics, not verified KOL quality analysis.

Where are results stored?

The script prints results and also writes the latest result set to scripts/last-search.json.

Which tools can use this skill?

The report declares compatibility with Claude, Codex, and Claude Code.

Developer Details

Author

um-why

License

MIT

Skillstore revision

Version notice

The author did not declare a version.

Repository

https://github.com/um-why/xiaohongshu-openclaw-skill/tree/main/

Ref

36e07d5e13068e5be64447e8f20b427cf2cbd21a

Maintenance freshness

7/18/2026

Usage

21 downloads · 106 views

File structure

📁 lib/

📄 key.js

📄 utils.js

📄 xiaohongshu.js

📁 scripts/

📄 search.js

📄 package.json

📄 readme.md

📄 SKILL.md

xiaohongshu-search

Install with my Agent

Agent-readable resources

Test it

Security Audit

Confirmed security concerns (5)

Risk Factors

Copy report link

Markdown badge

HTML badge

Embed card

APA citation

BibTeX citation

CITATION.cff

Skillstore Score

What You Can Build

Find Content Angles

Monitor Competitor Topics

Collect Research Samples

Try These Prompts

Best Practices

Avoid

Frequently Asked Questions

Developer Details

More from um-why

douyin-search-keyword

market-research-reports

competitor-analysis-bot

prospecting

deep-research

trade-show-finder

competitor-analysis

xiaohongshu-search

Install with my Agent

Agent-readable resources

Test it

Security Audit

Confirmed security concerns (5)

Risk Factors

Copy report link

Markdown badge

HTML badge

Embed card

APA citation

BibTeX citation

CITATION.cff

Skillstore Score

What You Can Build

Find Content Angles

Monitor Competitor Topics

Collect Research Samples

Try These Prompts

Best Practices

Avoid

Frequently Asked Questions

Developer Details

More from um-why

douyin-search-keyword

Related Skills

market-research-reports

competitor-analysis-bot

prospecting

deep-research

trade-show-finder

competitor-analysis