Xiaohongshu Ops

End-to-end Xiaohongshu (小红书 / RedNote) operations skill for setting content style, saving an operating profile, generating posts in that house style, choosin...

Security Scan

The skill's files, instructions, and runtime behavior are coherent with an automated Xiaohongshu posting tool; it requires local filesystem and browser automation but asks for no unrelated credentials or exotic installs.

Purpose & Capability

The name/description (Xiaohongshu ops: profile, generate, image strategy, publish) match the included scripts and references. Required resources are local files, a dedicated browser profile, and Playwright-based automation — all appropriate for the stated purpose. No unrelated cloud credentials or surprising binaries are requested.

Instruction Scope

SKILL.md and references explicitly instruct reading/writing local profile files (data/xiaohongshu/profile.json), generating temporary outputs under /tmp, and using a dedicated persistent browser profile (~/.openclaw/browser/xhs-independent-user-data) for publishing. The code automates a browser to upload images, fill title/body, and click the publish button. This is within scope, but worth noting: the scripts will launch persistent Playwright contexts, wait for login if needed, and can trigger a publish click automatically (xhs_independent_publish.js).

Install Mechanism

No install spec is provided (instruction-only repo with helper scripts). The JavaScript code requires Node and Playwright/Chromium at runtime. That is reasonable for this skill, but users must ensure Playwright and a Chromium runtime are installed separately; the skill will not install them for you.

Credentials

The skill declares no required environment variables or credentials. Scripts use process.env.HOME and optionally XHS_ env vars for convenience, which is proportional. No API keys or secrets are hardcoded or required by default. References mention stock-provider APIs but the included fetch script currently only emits a search plan rather than performing downloads.

Persistence & Privilege

always:false (no forced global presence). The skill writes/reads its own profile and reference files under data/xiaohongshu and creates a browser user-data-dir under ~/.openclaw/browser/xhs-independent-user-data. It also runs pkill -f to clear stale profile locks before launching the persistent browser context; this could terminate processes whose args match that string. These behaviors are coherent for a publishing automation tool but merit user attention because they affect local filesystem and processes.

Assessment

This skill appears to do what it says: automated Xiaohongshu profile management, content + image asset generation, and browser-driven publish automation. Before installing or running it, consider the following: - Review the publish scripts (scripts/xhs_independent_publish.js and scripts/xhs_publish.js). They will launch Playwright/Chromium, open a persistent browser profile at ~/.openclaw/browser/xhs-independent-user-data, upload images, fill fields, and can click the publish button automatically. If you want to prevent automatic publishes, set the profile to require review-before-publish or manually run the scripts in review mode. - Playwright/Chromium and Node are prerequisites; the skill does not include an install spec. Run it only in an environment where adding a persistent user-data-dir and launching browsers is acceptable. - The skill writes local files under data/xiaohongshu/ and /tmp/openclaw/uploads and will create ~/.openclaw/browser/xhs-independent-user-data. Do not point the skill at a browser profile that contains unrelated sensitive sessions or data. - The publish script uses spawnSync('pkill', ['-f', 'xhs-independent-user-data']) to clear locks. This is likely safe for its intended use but could kill any process whose command line matches that string; be cautious on multi-user or shared hosts. - There are no requested external credentials, and the stock-image planner only writes a plan (it does not automatically call Unsplash/Pexels APIs). If you plan to integrate stock provider APIs, add credentials intentionally and review that code path. - If you have limited trust in the skill author or want to be safer, run it in an isolated environment (container or VM), inspect/modify scripts to require manual confirmation before clicking the final publish selector, and enable review-before-publish in profile.json. If you want, I can point out the exact lines that perform browser automation and the pkill call so you can inspect them quickly.

Use this skill as the single entry point for Xiaohongshu operations.

Workflow

1. Read data/xiaohongshu/profile.json when it exists.
2. If profile setup is incomplete, ask concise setup questions and save the result with scripts/init_profile.js.
3. Read data/xiaohongshu/rules.md for current local operating rules.
4. Generate topic/title/body/page structure in the configured house style.
5. Choose image strategy from stock, cards-lite, or mixed.
6. Build assets and publish through the dedicated independent browser flow when publishing is requested.

Profile setup

Keep setup questions short. Cover positioning, goals, audience, style, image mode, publish preference, and whether auto learning should be enabled. Do not ask again for information the user already provided.

Watermark rule

Do not remove watermarks. Do not instruct or script watermark removal. If an image source has watermarks, reject it and choose a different source.

Auto learning

Support automatic daily learning in reference mode. If autoLearning.enabled is true in the profile, treat trend/style learning as a daily background reference task. Write learning outputs into local reference files instead of silently mutating the main profile.

Publish path

Use the dedicated independent browser profile for real publishing:

• ~/.openclaw/browser/xhs-independent-user-data

Do not treat the user's normal browser or OpenClaw's shared browser profile as the canonical publish path.

Offer first-run publish test

After setup, ask the user whether to do a first publish test.

Recommended wording:

• 是否要先自动生成并准备发布一篇测试笔记，顺手验证小红书发布链路是否正常？

References

Read these only when needed:

• references/questions.md — profile intake prompts
• references/profile-schema.json — profile fields and expected structure
• references/workflow.md — fuller operating workflow
• references/content-rules.md — title/body constraints and writing rules
• references/content-templates.md — content structure patterns
• references/content-output-format.md — expected output shape
• references/content-ideas.md — topic/angle inspiration
• references/image-sources.md — image sourcing guidance
• references/stock-providers.md — stock image source notes
• references/cards-usage.md — card-generation guidance
• references/cards-input-example.json — card input example
• references/publish-independent-browser.md — dedicated browser publish path
• references/publish-usage.md — publish flow details
• references/auto-learning.md — daily reference-learning behavior
• references/repo-notes.md — repository-oriented notes for standalone Git usage

Scripts

Use these scripts as low-freedom helpers when deterministic execution is better than rewriting logic inline:

• scripts/init_profile.js
• scripts/fetch_stock_images.js
• scripts/select_image_mode.js
• scripts/build_image_pipeline.js
• scripts/run_ops_once.js
• scripts/build_xhs_post.js
• scripts/generate_xhs_cards.js
• scripts/xhs_publish.js
• scripts/xhs_independent_browser.js
• scripts/xhs_independent_publish.js

Safety rule

Default to the profile's publish preference. If the profile says review-before-publish, stop for review. If the profile allows direct publish and the user asks for publishing, use the independent browser path.

File convention

Persistent config:

• data/xiaohongshu/profile.json

Runtime outputs can go under:

• /tmp/openclaw/uploads/xhs_*

Content storage rule

Do not treat generated post content as a long-term local content library. For each new run, default to regenerating:

• title
• body
• page structure
• images

Use runtime outputs as temporary working files only. Do not rely on old note content by default unless the user explicitly asks to reuse an older draft.

Active content constraints

Read references/content-rules.md when generating Xiaohongshu copy. Read data/xiaohongshu/rules.md as the local source of truth for current Xiaohongshu operating rules. Current default rules:

• title must be a natural phrase within 20 characters
• mixed Chinese/English titles should preserve important English terms instead of clipping them mid-word
• body should stay within 2000 characters

Integration

This skill orchestrates:

• content generation
• image strategy selection
• stock-image planning
• cards-lite fallback when needed
• dedicated-browser publishing

Use the saved profile as the style source of truth.