/xiaohongshu

name: xiaohongshu
description: 'Interact with Xiaohongshu (小红书, RED, Little Red Book) — search notes, read note details, view comments, browse user profiles and posts, get home feed. Use this skill whenever the user mentions Xiaohongshu, 小红书, RED, RedNote, Little Red Book, wants to search for lifestyle/beauty/travel content, read XHS discussions, look up XHS users, or browse trending notes. Also trigger when the user pastes a xiaohongshu.com URL (e.g. xiaohongshu.com/explore/noteid) or mentions an XHS note ID.'

Xiaohongshu

Search notes, read note details, view comments, browse user profiles, and get the home feed from Xiaohongshu (小红书).

Skill Directory

`<SKILL_DIR>` is the directory containing this SKILL.md file. Determine it ONCE at the start and reuse it.

Setup (run FIRST — every time, before any operation)

You MUST complete this setup before running any script. Do NOT skip.

sig status xiaohongshu 2>&1

Check the JSON output fields `configured` and `valid`:

• **`configured: false`** → run Provider Setup below.
• **`valid: false` (but configured: true)** → run `sig login xiaohongshu --mode visible`, **complete the captcha**, then re-check.
• **`valid: true`** → run Vendor Setup (one-time per machine), then execute the user's request.

Provider Setup

1. Read `<SKILL_DIR>/references/provider-config.yaml` 2. Append the provider block to `~/.sig/config.yaml` under `providers:` 3. Run `sig login xiaohongshu --mode visible` — a browser opens; scan the QR code with the Xiaohongshu app **and complete the slider/image captcha if prompted** 4. Verify: `sig status xiaohongshu` should show `valid: true`

Why the validateRule is so picky — three response shapes

`/api/sns/web/unread_count` is a permissive endpoint that hides a "partially expired cookie" state behind what looks like a successful response. The provider's `validateRule` is built specifically to reject it:

| State | `/api/sns/web/unread_count` returns | Detected as | | --------------------------------- | ------------------------------------------------------------- | --------------------------------------------- | | Healthy cookie | `{code:0, success:true, data:{unread_count:N, likes:N, ...}}` | ✅ valid | | **Cookie partially expired** | `{code:0, success:true, data:{}}` | ❌ rejected by `Object.keys(data).length > 0` | | Cookie fully expired / logged out | `{code:-101, success:false, msg:"无登录信息"}` | ❌ rejected by `code === 0` |

If `sig login` exits without prompting you, but later API calls fail with empty data — the partially-expired-cookie state was bypassed by a stale rule. Re-pull `references/provider-config.yaml` and refresh the rule in `~/.sig/config.yaml`, then re-login.

> **What this rule does NOT catch.** `unread_count` is more permissive than search/feed APIs. A cookie that passes the rule (state #1) may still fail on search if the risk-control / session-token portion has aged out. If `sig status` shows `valid:true` but search keeps returning empty data, you're in this gray zone — the only fix is `sig logout xiaohongshu && sig login xiaohongshu --mode visible`. See **Diagnosis** below for how to confirm.

Vendor Setup (one-time per machine)

Unlike most skills, xiaohongshu signs every request via JS files at `<SKILL_DIR>/vendor/static/`, evaluated through PyExecJS. The skill ships those source files but not their npm/pip deps — install them once:

node --version                          # must be >= 18; install from https://nodejs.org if missing
cd <SKILL_DIR>/vendor && npm install    # installs crypto-js, jsdom
pip install --user -r <SKILL_DIR>/requirements.txt   # PyExecJS, requests, loguru, retry

If `pip` complains about externally-managed Python (PEP 668 on macOS/Debian), use a venv or `pipx`.

Smoke-test signing (no network, no cookie needed):

cd <SKILL_DIR>/vendor && python3 -c "
import sys; sys.path.insert(0, '.')
from xhs_utils.xhs_util import generate_x_rap_param, generate_xs_xs_common
xs, xt, xsc = generate_xs_xs_common('a1=test', '/api/sns/web/v1/feed', '', 'POST')
rap = generate_x_rap_param('/api/sns/web/v1/user_posted', '')
print('OK' if xs and rap else 'FAIL')
"

Expect `OK`. If it fails, see Error Handling.

Running Scripts

All scripts output JSON to stdout. Read operations need a cookie (the public site does not allow anonymous access to most endpoints).

**Recommended — `sig run` injects the cookie as `SIG_XIAOHONGSHU_COOKIE`:**

sig run xiaohongshu -- bash -c 'python3 <SKILL_DIR>/scripts/xiaohongshu_search_note.py --keyword "AI" --page 1'

**Alternative — pass `--cookie` explicitly:**

COOKIE=$(sig get xiaohongshu --no-redaction --format value)
python3 <SKILL_DIR>/scripts/xiaohongshu_search_note.py --keyword "AI" --cookie "$COOKIE"

Scripts Reference

All scripts are in this skill's `scripts/` directory. Output is JSON to stdout.

| Script | Purpose | Auth | | ---------------------------------- | ------------------------------------ | ------ | | `xiaohongshu_search_note.py` | Search notes by keyword | Cookie | | `xiaohongshu_get_note_info.py` | Get full note detail by URL | Cookie | | `xiaohongshu_get_note_comments.py` | Get top-level comments on a note | Cookie | | `xiaohongshu_get_user_info.py` | Get a user's profile | Cookie | | `xiaohongshu_get_user_notes.py` | Get notes published by a user (page) | Cookie | | `xiaohongshu_get_homefeed.py` | Get home feed recommendations (page) | Cookie |

Script Arguments

`xiaohongshu_search_note.py`

• `--keyword` (required) — search keyword
• `--page` — page number, default `1`
• `--sort` — `0` general (default), `1` newest, `2