← Back to Skills Marketplace
XhsSkills
by
Cheng Zhen
· GitHub ↗
· v3.0.1
· MIT-0
130
Downloads
0
Stars
0
Active Installs
8
Versions
Install in OpenClaw
/install xhs-apis
Description
Use this skill when you need to call the vendored Xiaohongshu/XHS APIs from Spider_XHS for PC web data or creator-platform publishing data. This skill only w...
Usage Guidance
This skill bundles vendored Spider_XHS code to call Xiaohongshu APIs; that is coherent with its description. Before installing or using it: 1) Review the included code yourself (especially the large JS bundles) or run it in an isolated environment/container. 2) Do not supply cookies from a primary/production account — create and use a test account or scoped credentials if possible, because cookies grant full session access. 3) Be aware the CLI will read any local file paths you pass (images/videos) and will upload their bytes to XHS; avoid passing sensitive local files. 4) Note the runtime may fetch additional JS/chunks from XHS CDNs at runtime — if you require an offline/auditable runtime, extract and pin all bundles locally. 5) The pre-scan flagged possible hidden/encoded content in SKILL.md (base64/unicode-control chars); inspect the raw files for hidden payloads before trusting. If you are not comfortable auditing the code, run it only in a sandbox or decline installation.
Capability Tags
Capability Assessment
Purpose & Capability
The name/description say it wraps Spider_XHS PC and creator APIs and the bundle contains xhs_pc_apis.py, xhs_creator_apis.py, JS signers, and a CLI tool. The included Python and Node dependencies (requests, PyExecJS, jsdom, crypto-js, opencv/numpy) are consistent with making signed XHS requests and handling media uploads.
Instruction Scope
SKILL.md limits runtime actions to installing dependencies and running the included CLI which takes cookies_str and file paths. That matches the code. However the vendored JS runtime contains logic that will attempt to resolve/load webpack chunks from XHS CDNs at runtime (fe-static.xhscdn.*), which is not explicitly documented in the SKILL.md and increases the runtime network surface. Also the CLI will read any local file paths you pass (for media upload), so supplying paths or cookie strings gives the code access to local files and account session data.
Install Mechanism
There is no official 'install' spec in the skill manifest, but SKILL.md instructs pip and npm installs. The packages listed (opencv-python, numpy, PyExecJS, jsdom, crypto-js) are heavy but plausible for media processing and JS signing. The vendored JS concatenation is executed via Node Module._compile — expected for bundled code — and the JS runtime references remote CDN paths, meaning additional code or assets may be fetched at runtime from vendor CDNs.
Credentials
The skill declares no environment variables or credentials, which aligns with the CLI model (it expects cookies passed per-call). That is proportional, but the required input (cookies_str) is highly sensitive: providing account cookies grants the skill the same privileges as the user session. The CLI also reads local files (images/videos) into memory for upload — that is necessary for the creator upload feature but means the tool can access arbitrary local paths you pass.
Persistence & Privilege
The skill is not always-enabled, doesn't request system-level persistence, and does not modify other skill configs. It runs only when invoked.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install xhs-apis - After installation, invoke the skill by name or use
/xhs-apis - Provide required inputs per the skill's parameter spec and get structured output
Version History
v3.0.1
- Added new static signer script: scripts/runtime/spider_xhs_core/static/xhs_creator_sign_other_part2.js
- No changes to interface or documentation.
v3.0.0
Version 3.0.0 of xhs-apis
- Added new static signer script: xhs_creator_sign_other_part1.js.
- Removed legacy static signer script: xhs_creator_sign_other_part4.js.
- Maintains support for all previous PC web and creator-platform API workflows.
v1.0.6
- Updated static JS signer file: replaced xhs_creator_sign_other_part3.js with xhs_creator_sign_other_part4.js.
- No changes to documentation or workflow; runtime usage remains the same.
v1.0.5
No changes detected in this version (1.0.5); the skill remains functionally the same as before.
v1.0.3
- Replaced static JavaScript signer file part 4 with part 3 in the runtime.
- No changes to APIs or CLI usage.
v1.0.2
- Added new file: scripts/runtime/spider_xhs_core/static/xhs_creator_sign_other_part4.js
- No changes to skill description or usage; functionality extended with additional static JS resource.
v1.0.1
Initial public release of xhs-apis.
- Added command-line interface to call vendored Xiaohongshu/XHS APIs for PC and creator-platform workflows.
- Bundled all necessary Python scripts, runtime modules, JavaScript signers, and utilities for note, user, search, comment, topic, location, media upload, and publishing APIs.
- Provided documentation, example usage, and detailed parameter guidance.
- Included both Python and Node.js dependency setup instructions.
v1.0.0
Initial release of xhs-apis skill.
- Provides a wrapper for Xiaohongshu/XHS PC web and creator-platform APIs via Spider_XHS.
- Supports note, user, search, comment, topic, location, media upload, note publishing, and creator published-note queries.
- Includes both CLI usage instructions and parameter rules for different API namespaces.
- Bundles runtime and dependency setup guidance for both Python and Node environments.
Metadata
Frequently Asked Questions
What is XhsSkills?
Use this skill when you need to call the vendored Xiaohongshu/XHS APIs from Spider_XHS for PC web data or creator-platform publishing data. This skill only w... It is an AI Agent Skill for Claude Code / OpenClaw, with 130 downloads so far.
How do I install XhsSkills?
Run "/install xhs-apis" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is XhsSkills free?
Yes, XhsSkills is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does XhsSkills support?
XhsSkills is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created XhsSkills?
It is built and maintained by Cheng Zhen (@cv-cat); the current version is v3.0.1.
More Skills