xiaohongshu-dailytop

This script fetches ranking data from redfox[.]hk using an API key obtained from the REDFOX_API_KEY environment variable or shell startup files, and writes a generated HTML report. Unescaped remote or cached content can lead to HTML/JavaScript injection when the report is opened, and the script exposes the API key to its configured API endpoint. The insufficient-credit path promotes an external alipay-bot payment workflow but does not execute it directly. Severity is moderate due to credential handling and report injection risk; no clear malware behavior is evident.