xiaohongshu-lowtop

SUSPICIOUS。技能目的与“抓取第三方爆款数据并导出报告”基本一致，但其实际信任边界落在 RedFoxHub 而非小红书官方，且会扫描本地 shell/profile 文件读取 API Key，范围偏宽。未见明确恶意载荷或危险安装链，因此更像中等风险的第三方数据技能，而非确认恶意。

This module is primarily a data-fetching and report-generation script, but it has multiple security red flags relevant to supply-chain trust: it disables TLS certificate verification/hostname checking (enabling MITM response manipulation), it scavenges REDFOX_API_KEY from user shell/profile files when not present in the environment, and it partially logs the API key to stderr. Additionally, the optional HTML generation path interpolates untrusted remote fields into HTML without sanitization, which could lead to XSS when the generated HTML is viewed in a browser. No explicit malware/backdoor behavior is evident in the provided code fragment; risk is dominated by insecure transport, sensitive secret handling, and unsafe content injection behavior.