cultural-tourism-xiaohongshu-feed

The code appears to be a data-fetching and reporting utility rather than clear malware. It contains two notable security risks: unsanitized remote content is embedded into HTML, enabling potential stored XSS, and the subscription crontab command uses shell=True with interpolated input, enabling command injection through a crafted keyword. The hardcoded API endpoint and API-key transmission are expected application behavior but should be independently trusted and reviewed. The supplied fragment is incomplete, so omitted code could change the assessment.

SUSPICIOUS: the skill is mostly coherent with its stated reporting purpose, and installation uses a normal PyPI dependency. The main concern is data-flow integrity: Xiaohongshu-related queries and API credentials are routed through RedFoxHub’s intermediary API instead of official service endpoints, plus the skill encourages plaintext key storage and some autonomous behavior. This is not confirmed malware, but it carries medium risk and warrants caution.