What Xhs Skill does
Cookie login plus browser-stealth publishing and export.
These are the suites: login plus publish plus analytics plus reply handling bundled into one install. They dominate the download counts in the snapshot, and the same property that makes them popular — one command covers everything — is what makes them the largest blast radius if a selector or an endpoint changes underneath you.
Profile at a glance
| Opportunity score | 175.8 |
|---|---|
| Downloads | 2,158 |
| Installs | 16 |
| Risk | High |
| Persona | Operator / agency |
| Category | Comprehensive operations |
| Install command | clawhub install xhs-skill |
Why the risk label says High
A High label means the skill touches your account in a way other people can see: it logs in, publishes, replies, or drives a real browser session on your behalf. That is what makes these rows the most useful and the most likely to be classified as inauthentic behaviour. Treat every High row as human-approval-required, and make the first run on a test account rather than the one you publish from.
Read the dependency list before the feature list. A suite that silently requires a real logged-in browser session is doing something very different from one that only reads public pages, even when the marketing copy is identical.
Check it before you install
- Check the skill's own repository or documentation. The shared source page behind this snapshot is a starting point; it is not evidence that the row is still maintained.
- Read the risk label as an action question: does it only read public content, or does it need a logged-in session, or does it publish on your behalf?
- Run it once in an isolated session or a test account. Do not make the first attempt on your main account.
- Write down the single smallest thing you want it to do, then check only that after the first run.
More Comprehensive operations skills
Browse the full directory, the Comprehensive operations category, or the High-risk list.