技能 xiaohongshu-search
📦
xiaohongshu-search
内容修订 r1 高风险 ⚙️ 外部命令🌐 网络访问📁 文件系统访问🔑 环境变量
搜索小红书市场趋势
当团队手动检查笔记、创作者和互动信号时，小红书研究可能需要数小时。此技能可按关键词搜索公开笔记，并返回结构化结果，以便更快进行内容和市场分析。
支持: Claude Codex Code(CC)
安装前请停下并请求确认。
请审查安装计划，并在更改文件前获得用户明确同意。
使用我的智能体安装
将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。
智能体请求
Review the Skillstore skill "xiaohongshu-search" from https://skillstore.io/skills/um-why-xiaohongshu-search.md and its manifest at https://skillstore.io/api/skills/um-why-xiaohongshu-search/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.你的智能体仍应展示其计划，并按安全策略请求必要确认。
Agent 可读资源
当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。
测试它
正在使用“xiaohongshu-search”。 搜索 "AI tutorial"，返回 10 条综合结果。
预期结果:
一个排序后的结果列表，包含笔记标题、发布时间、笔记链接、创作者名称和互动数量。
正在使用“xiaohongshu-search”。 搜索 "spring outfits"，作为图文笔记并按点赞数排序。
预期结果:
一个 Markdown 摘要，展示点赞数最高的公开笔记及其可见互动指标。
正在使用“xiaohongshu-search”。 搜索一个品牌关键词并保存最新结果。
预期结果:
控制台输出，以及一个包含最新结构化结果集的本地 last-search.json 文件。
安全审计
高风险v5 • 2026/7/7 打开版本化报告
Most shell execution and obfuscation alerts are false positives from JavaScript template literals, ANSI escape codes, Markdown examples, and Chinese text. Confirmed issues are the external API dependency, token handling through environment or default credentials, and persistent local result caching. No prompt injection evidence was found in the reviewed files.
7
已扫描文件
734
分析行数
8
复核项
0
已忽略误报
已确认安全问题 (5)
高
Environment file access
const token = key.apiKey(process.env.GUAIKEI_API_TOKEN);
The flagged line reads GUAIKEI_API_TOKEN, which is then used in outbound API requests. The pattern is not an environment file read, but it is sensitive credential handling.
高
[HEURISTIC] Very high entropy string (5.59 bits) - likely encoded/encrypted payload
未正确设置 GUAIKEI_API_TOKEN 环境变量, 将使用默认值, 可能影响搜索效率或搜索频率受限, 建议升级为私有TOKEN以获得更好的搜索体验
The surrounding token module returns a bundled default API token when GUAIKEI_API_TOKEN is absent. A shared embedded credential is a real security and abuse risk.
高
Bundled Default API Token
The token helper returns a hardcoded default token when GUAIKEI_API_TOKEN is missing. Shared fallback credentials can be abused and make API usage hard to attribute.
The fallback branch directly returns a 32-character token string after warning the user. The behavior is explicit in the token management module.
高
API Token Sent In URL Query Parameters
The API token is placed into query parameters for task creation and result lookup. Query strings are often logged by clients, proxies, and services.
The script reads GUAIKEI_API_TOKEN and both request builders include token in querystring parameters. This is direct evidence of credential exposure through URLs.
中
Search Results Persisted Locally
The command writes the latest complete result object to scripts/last-search.json. This can retain user keywords, Xiaohongshu links, and returned profile metadata after the command finishes.
The final output object contains keyword, result links, metrics, and metadata, then writeFileSync saves it locally. The code has no opt-out or retention setting.
能力复核项 (8)
这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。
中
HTTP/HTTPS request
const req = https.request(options, (res) => {
The code makes HTTPS requests to the external Guaikei service and includes user keywords and token-derived parameters. This is expected functionality but still transfers data outside the local environment.
中
HTTP/HTTPS request
const req = https.request(options, (res) => {
The code makes HTTPS requests to the external Guaikei service and includes user keywords and token-derived parameters. This is expected functionality but still transfers data outside the local environment.
中
HTTP client library
const req = https.request(options, (res) => {
The code makes HTTPS requests to the external Guaikei service and includes user keywords and token-derived parameters. This is expected functionality but still transfers data outside the local environment.
中
HTTP client library
const req = https.request(options, (res) => {
The code makes HTTPS requests to the external Guaikei service and includes user keywords and token-derived parameters. This is expected functionality but still transfers data outside the local environment.
中
Node.js fs operations
fs.writeFileSync(outputPath, JSON.stringify(finalOutput, null, 2));
The script writes the full final search output to scripts/last-search.json. This can persist user keywords, result links, and returned metadata without a retention control.
中
Synchronous file operations
fs.writeFileSync(outputPath, JSON.stringify(finalOutput, null, 2));
The script writes the full final search output to scripts/last-search.json. This can persist user keywords, result links, and returned metadata without a retention control.
中
Environment variable access (dot notation)
const token = key.apiKey(process.env.GUAIKEI_API_TOKEN);
The command reads GUAIKEI_API_TOKEN from process.env and passes it into external API calls. Accessing a secret-bearing environment variable is security relevant.
中
Environment variable object
const token = key.apiKey(process.env.GUAIKEI_API_TOKEN);
The command reads GUAIKEI_API_TOKEN from process.env and passes it into external API calls. Accessing a secret-bearing environment variable is security relevant.
风险因素
⚙️ 外部命令 (58)
lib/utils.js:22 lib/xiaohongshu.js:15 lib/xiaohongshu.js:19 lib/xiaohongshu.js:23 lib/xiaohongshu.js:28 lib/xiaohongshu.js:52 lib/xiaohongshu.js:57 lib/xiaohongshu.js:62 lib/xiaohongshu.js:67 lib/xiaohongshu.js:75 lib/xiaohongshu.js:79 lib/xiaohongshu.js:80 lib/xiaohongshu.js:81 lib/xiaohongshu.js:82 lib/xiaohongshu.js:84 lib/xiaohongshu.js:86 lib/xiaohongshu.js:87 lib/xiaohongshu.js:88 lib/xiaohongshu.js:89 lib/xiaohongshu.js:93 lib/xiaohongshu.js:104 lib/xiaohongshu.js:113 lib/xiaohongshu.js:117 lib/xiaohongshu.js:171 lib/xiaohongshu.js:175 lib/xiaohongshu.js:185 lib/xiaohongshu.js:187 lib/xiaohongshu.js:207 lib/xiaohongshu.js:215 lib/xiaohongshu.js:219 lib/xiaohongshu.js:224 lib/xiaohongshu.js:286 lib/xiaohongshu.js:290 lib/xiaohongshu.js:300 lib/xiaohongshu.js:302 scripts/search.js:13-33 scripts/search.js:80 scripts/search.js:86 scripts/search.js:92 scripts/search.js:101 scripts/search.js:105 scripts/search.js:106 scripts/search.js:110 scripts/search.js:131 scripts/search.js:134 scripts/search.js:165 scripts/search.js:202 scripts/search.js:205 scripts/search.js:211 SKILL.md:59 SKILL.md:63-65 SKILL.md:65-69 SKILL.md:69-70 SKILL.md:70-71 SKILL.md:71-72 SKILL.md:72-76 SKILL.md:76-91 SKILL.md:91-101
🌐 网络访问 (9)
📁 文件系统访问 (15)
lib/xiaohongshu.js:84 scripts/search.js:40 scripts/search.js:113 scripts/search.js:117 scripts/search.js:161 scripts/search.js:210 scripts/search.js:39 scripts/search.js:107 scripts/search.js:108 scripts/search.js:160 scripts/search.js:117 scripts/search.js:210 scripts/search.js:3 scripts/search.js:4 scripts/search.js:5
🔑 环境变量 (2)
审计者: codex 查看审计历史 →
分享与引用此报告
分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。
复制报告链接
https://skillstore.io/skills/um-why-xiaohongshu-search/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/um-why-xiaohongshu-search?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/um-why-xiaohongshu-search?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/um-why-xiaohongshu-search/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/um-why-xiaohongshu-search.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>学术引用 (APA · BibTeX · CFF)
APA 引用
um-why. (2026). xiaohongshu-search security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/um-why-xiaohongshu-search/audits/5BibTeX 引用
@techreport{um-why-um-why-xiaohongshu-search-2026,
author = {um-why},
title = {xiaohongshu-search security audit report (audit version 5)},
institution = {Skillstore},
year = {2026},
number = {5},
url = {https://skillstore.io/skills/um-why-xiaohongshu-search/audits/5},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "xiaohongshu-search security audit report (audit version 5)"
version: "unspecified"
type: report
authors:
- name: "um-why"
date-released: "2026-07-07"
url: "https://skillstore.io/skills/um-why-xiaohongshu-search/audits/5"
identifiers:
- type: other
value: "skillstore:um-why-xiaohongshu-search:audit:5"
description: "Skillstore immutable audit report identifier"
Skillstore 评分
评分依据 证据置信度: 中 59
架构
85
可维护性
85
内容
69
社区
83
规范符合性
你能构建什么
寻找内容创意
搜索某个主题，并在规划新的小红书帖子前查看高互动笔记。
监测竞品话题
跟踪品牌或品类关键词，查看近期公开笔记和互动信号。
构建研究快照
收集结构化关键词结果，用于快速趋势检查和活动规划。
试试这些提示
基础关键词搜索
在小红书搜索 "summer skincare"，并以 JSON 格式返回 10 条结果。
视频趋势检查
在小红书搜索 "home workout" 视频，并按最新结果排序。
高互动回顾
在小红书搜索 "camping gear"，返回 20 条图文笔记，并按点赞数排序。
竞品监测快照
在小红书搜索我们的竞品品牌关键词，以 Markdown 返回 30 条结果，并总结标题、链接、创作者和互动模式。
最佳实践
- 使用私有 GUAIKEI_API_TOKEN；如果日志可能暴露查询字符串，请轮换该 token。
- 保持关键词具体，并控制在 2 到 50 个字符之间，以获得更干净的结果。
- 当搜索结果不应保留在磁盘上时，删除 last-search.json。
避免
- 没有有效业务理由时，不要搜索私密、敏感或可识别个人身份的词语。
- 不要将返回的互动数量视为已经验证无作弊的分析数据。
- 在未检查小红书平台条款和数据使用规则前，不要发布结果。
常见问题
这个技能会直接抓取小红书吗？
不会。该代码会向 Guaikei API 发送关键词搜索请求，并格式化返回的结果。
它需要哪些凭证？
它期望在环境中提供 GUAIKEI_API_TOKEN。内置备用 token 存在，但可能受限。
token 会发送到哪里？
该 token 会通过 HTTPS 查询参数发送到 www.guaikei.com，用于创建和检索搜索任务。
它会在本地存储结果吗？
会。成功搜索后，它会将最新结果集写入 scripts/last-search.json。
它能自动分析 KOL 质量吗？
它可以从搜索结果中返回创作者和互动字段，但不会验证受众质量或真实性。
我可以将它与 Claude、Codex 和 Claude Code 一起使用吗？
可以。当运行时要求可用时，报告会标记支持 Claude、Codex 和 Claude Code。