/xiaohongshu

name: xiaohongshu
description: "Read Xiaohongshu (小红书) through OpenCLI using the user's Chrome logged-in session. Search notes, read note details and comments, browse feed and user notes, or download note media. Keywords: xiaohongshu, xhs, 小红书, 红书, 笔记, 评论, feed."

Xiaohongshu Skill (Read-Only)

Use OpenCLI as the single supported Xiaohongshu implementation. The previous HTTP/API and Chrome Cookie DB extraction path was removed because Xiaohongshu frequently requires browser-side login verification and risk-control handling.

When To Use

Triggered by:

• "小红书搜 [query]", "search xiaohongshu [query]"
• "读小红书笔记", "read xhs note [url]"
• "小红书评论", "xhs comments"
• "小红书 feed", "小红书首页"
• "小红书用户主页", "xhs user"

Prerequisites

1. Node.js and npm are installed. OpenCLI 2.0.3 requires Node.js >=20.18.1. 2. OpenCLI is installed. Before installing or upgrading, read [the upgrade review](references/opencli-upgrade.md). The reviewed combination is OpenCLI 2.0.3 with actual runtime dependencies `undici 7.30.1` and `js-yaml 4.3.2`. This release includes the required dependency update; the previous 1.8.8 / 7.29.1 combination is no longer the reviewed baseline. Recheck actual dependencies and current advisories after any reinstall or update. 3. The OpenCLI Chrome extension is installed manually from the Chrome Web Store. OpenCLI 2.0.3 requires extension 1.0.27 or newer; confirm the connected version with `opencli daemon status` before changing anything. 4. Chrome is open and logged into Xiaohongshu.

Check status without starting or changing the daemon:

node --version
opencli --version
opencli daemon status

Do not run `opencli doctor` for routine checks; it can start the daemon.

Commands

Search notes:

opencli xiaohongshu search "<query>" -f yaml

On a separately reviewed installation that supports the reviewed search options, filter recent image notes:

opencli xiaohongshu search "<query>" --sort latest --note-type image --publish-time week --limit 5 -f yaml

Check `opencli xiaohongshu search --help` before using these options. Older versions may not support them. Location filters can require browser geolocation permission; do not grant that permission just to make a search succeed.

Read a note:

opencli xiaohongshu note "<full_note_url_with_xsec_token>" -f yaml

Read comments:

opencli xiaohongshu comments "<full_note_url_with_xsec_token>" --limit 5 -f yaml

Browse feed:

opencli xiaohongshu feed -f yaml

Read a user's public notes:

opencli xiaohongshu user "<user_id>" -f yaml

Download media from a note:

opencli xiaohongshu download "<full_note_url_with_xsec_token>" --output "./xiaohongshu-downloads" -f yaml

`note` and `comments` require a full signed note URL from search, feed, or profile results; a bare note ID is insufficient. `download` also accepts note share links, but a profile share link is not a note.

Recommended Workflows

Preflight

1. Check that the daemon and Chrome extension are available:

opencli daemon status

2. Check Xiaohongshu login state before reading search results, profiles, or notes:

opencli xiaohongshu whoami -f yaml --window background --site-session persistent --trace off

`whoami` checks the creator-side session; success does not prove every content page is accessible. If a target page returns `AUTH_REQUIRED`, stop the batch and ask the user to refresh login in Chrome. Preserve network/service errors as such; do not interpret every `whoami` failure as expired login. Do not switch to cookie extraction or unofficial APIs.

If OpenCLI returns `BROWSER_CONNECT` or cannot bind `127.0.0.1:19825`, the daemon may be blocked by the current sandbox. Start or check the daemon from an unrestricted host shell when available, then rerun the same OpenCLI command. Do not use `opencli doctor` for routine checks.

Risk Controls and Local Evidence

• OpenCLI 2.0.3 internally retries `note`, `comments`, and `download` at most once after an 8-18 second cooldown on a detected soft block. Older versions may fail immediately. This is not a cross-command rate limiter or a guarantee against account restrictions.
• If a command returns `SECURITY_BLOCK`, or a captcha/account warning appears, stop the whole batch. Do not wrap it in an outer retry loop or switch accounts, sessions, IPs, or tools to continue through the restriction. Leave verification to the user.
• Run batch commands serially with a deliberate pause between notes. Start with a small probe and expand only to the requested scope; no particular delay guarantees safety.
• Keep trace capture off by default. Enable `--trace retain-on-failure` only for a bounded diagnostic run. Signed URLs, manifests, traces, screenshots, and account data stay local; redact tokens and identity details from shared reports and never commit them.

Profile Share Links

Do not pass a profile `xhslink.com/m/...` URL directly to `opencli xiaohongshu user` and assume the short-link tail is the user id. In practice, OpenCLI may incorrectly navigate to:

https://www.xiaohongshu.com/user/profile/<short-link-tail>

If the trace shows a `404` for that URL, the `EMPTY_RESULT` error is probably a bad profile id, not proof that the user has no public notes.

For profile share links, first resolve the canonical profile URL:

• Prefer a real URL like `https://www.xiaohongshu.com/user/profile/<user_id>?xsec_token=...`.
• If only a short link is available, ask the user to open it while logged in, then read the final URL from the current Chrome tab or recent Chrome history.
• Use Chrome only for URL resolution or visible-page confirmation. Keep Xiaohongshu data extraction in OpenCLI.

After resolving the canonical profile URL, probe the profile:

opencli xiaohongshu user "<canonical_profile_url>" --limit 5 -f yaml --window background --site-session persistent --trace off

If `search "<creator_name