xhs-note-creator

No explicit malware/backdoor patterns (eval/exec/subprocess/persistence) are visible in the provided wrapper code. The dominant security concern is credential exposure: in --api-mode the tool sends the raw XHS_COOKIE to a configurable HTTP API endpoint ({api_url}/init) without HTTPS enforcement or destination restrictions, creating a real credential-exfiltration risk if api_url is misconfigured, intercepted, or the API service is compromised. Local mode primarily delegates risk to the external xhs library for signing/publishing behavior.

SUSPICIOUS: 内容创作与图片渲染部分与技能目的基本一致，但“发布”部分依赖 XHS_COOKIE，与已知官方小红书开放平台认证方式不一致，且实际网络端点与脚本实现不可见。未发现明确恶意下载执行链，但凭据使用方式不透明、可代表用户真实发帖，使整体风险偏高。