xhs-content-ops

SUSPICIOUS. The skill is mostly aligned with its stated Xiaohongshu research purpose, and the noted dependency provenance is plausibly legitimate. Risk comes from local session-cookie/UA file access, browser automation, and remote binary installation; these are proportionate to the task but materially expand trust and credential exposure, so the skill is better classified as medium-risk rather than benign.