xhs-auto

SUSPICIOUS: the skill is broadly aligned with Xiaohongshu posting automation, and its installs are from standard ecosystems, but it enables real-world social posting and relies on a third-party publishing CLI plus possible API relay configuration. Risk is moderate from autonomy and external-service trust, not from clear malware or overt credential theft.