xhs-note-creator

SUSPICIOUS. The skill's content creation and image rendering are aligned with its purpose, but the optional publishing path relies on an unofficial third-party library, manual browser-cookie extraction, and public posting capability. This is not confirmed malware, but it carries meaningful credential, supply-chain, and real-world action risk.