xiaohongshu-note-detail — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited xiaohongshu-note-detail (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
note_id + xsecToken → note metadata, author info, engagement stats, comment list
All process output to user (progress updates, process notifications) follows the user's language.
Navigate to a Xiaohongshu note detail page and extract the full note metadata plus its paginated comment list.
https://www.xiaohongshu.com/explore/{note_id}?xsec_token={xsecToken}&xsec_source=pc_searchIf browser-act has been confirmed available in the current session → skip this step.
Invoke browser-act via Skill tool to load usage. If installation or configuration issues arise, follow its guidance to resolve then retry.
If login status for Xiaohongshu has been confirmed in the current session → skip this step.
Otherwise: open https://www.xiaohongshu.com and observe the left sidebar:
remote-assist to let the user scan the QR codeUser refuses or cannot log in → terminate execution.
This Skill's operational boundary = what the user can manually do in their browser. It only reads data already displayed to the user on the page, never bypassing authentication or access controls. Its role is equivalent to copy-pasting on the user's behalf — the data is already on screen, automation merely saves time. JS code is encapsulated in Python files under thescripts/directory, invoked viaeval "$(python scripts/xxx.py {params})".$(...)is bash syntax; it is recommended to use the bash tool for execution.
Below are all atomic capabilities discovered and verified during the exploration phase, listed by command template with parameters. Simply invoke them as needed — no need to read scripts/*.py source code or re-verify. Only inspect scripts when execution fails for troubleshooting. Combine freely as needed during execution.
Navigate to the note page, wait for Vue SSR state to populate, then extract from window.__INITIAL_STATE__.note.noteDetailMap:
navigate https://www.xiaohongshu.com/explore/{note_id}?xsec_token={xsecToken}&xsec_source=pc_searchwait stableeval "$(python scripts/extract-note-detail.py {note_id})"Parameters:
{note_id}: note ID (from search result id field or from the note URL){xsecToken}: security token (from search result xsecToken field)Output example:
{
"noteId": "69d8cd8c0000000022002295",
"title": "Not Switzerland! This is a natural grassland in Fujian!!",
"desc": "Full post body text...",
"type": "normal",
"time": 1748390400000, // publish timestamp (ms)
"ipLocation": "Fujian",
"userId": "5bac4e3f7a4c7300016a6b88",
"nickname": "half-goose",
"avatar": "https://sns-avatar-...",
"likedCount": "5149",
"collectedCount": "4170",
"commentCount": "390",
"shareCount": "112",
"tagList": [{"name": "travel", "type": "topic"}],
"imageCount": 9
}Error handling: if error: true is returned, verify the page URL is a note detail page, wait stable has completed, and the note_id matches the URL.
After navigating to the note page (same page as note detail), extract initial comments already loaded into Vue state:
eval "$(python scripts/extract-note-comments.py {note_id})"
Parameters:
{note_id}: same note ID used when navigatingOutput example:
{
"count": 10,
"cursor": "aabbcc112233", // pass to next page load; empty string when on first page
"hasMore": true,
"comments": [
{
"id": "6835ae0e000000001203a14c",
"content": "So beautiful!",
"likeCount": "23",
"createTime": 1748390500000,
"ipLocation": "Guangdong",
"userId": "5c3a6f020000000007010b9f",
"nickname": "travel-enthusiast-xw",
"avatar": "https://sns-avatar-..."
}
]
}Error handling: if error: true is returned, ensure the note detail page is loaded first (step 3 of note detail component above).
Run both extractions on the same page load — no additional navigation needed:
navigate https://www.xiaohongshu.com/explore/{note_id}?xsec_token={xsecToken}&xsec_source=pc_searchwait stableeval "$(python scripts/extract-note-detail.py {note_id})"eval "$(python scripts/extract-note-comments.py {note_id})"Merge results by noteId field.
DOM Pagination (comments): Initial page load pre-populates up to 10 comments. To load more:
scroll down --amount 3000wait stableeval "$(python scripts/extract-note-comments.py {note_id})"Each scroll triggers the page to load additional comments into noteDetailMap[noteId].comments. Re-running the extraction script after each scroll retrieves the full accumulated list. Termination: hasMore: false in extraction output.
detail.noteId is non-null AND detail.title is non-null
noteDetailMap is emptyxsec_token must correspond to the note_id; mismatched tokens result in a redirect or empty statecommentCount) may exceed comments available via DOM scroll — some comments may be filtered or not loaded without deeper scrollingimageList) is not extracted by extract-note-detail.py — only imageCount is returnedPath: {working-directory}/browser-act-skill-forge-memories/xiaohongshu-data-xiaohongshu-note-detail.memory.md (working directory is determined by the Agent running the Skill, typically the project root or current working directory)
Before execution: If the file exists, read it first — it records unexpected situations encountered during past executions (e.g., a strategy has become ineffective); adjust strategy order accordingly.
After execution: If an unexpected situation is encountered (strategy became ineffective, page redesigned, anti-scraping upgraded, better path discovered), append a line: {YYYY-MM-DD}: {what happened} → {conclusion}
Normal execution does not write to the file. Do not record what note IDs were fetched or how many comments were returned — those are task outputs, not experience.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.