Security audit

小红书长图文发布

Security checks for vulnerabilities and agentic risk

Overview

This skill is a plain instruction guide for publishing Xiaohongshu posts and does not contain hidden code, persistence, or unrelated data access.

Install only if you intend to let the agent operate your logged-in Xiaohongshu creator page. Before the final publish step, review the selected account, title, body, tags, location, originality setting, and preview because the workflow can submit a real public post for platform review.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill culminates in clicking a real platform's “发布” button and verifying the newly created note in account management, but it does not clearly warn that this performs a live public submission from the user's logged-in Xiaohongshu account. In an automation context, the absence of an explicit consent/checkpoint before publication increases the risk of accidental posting, reputational harm, and unintended disclosure of user-provided content.

Natural-Language Policy Violations

Low

Confidence: 80% confidence
Finding: All user-facing instructions are in Chinese and the skill does not indicate whether this is a locale-specific skill or whether another language is supported. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy issue unless the locale constraint is explicitly documented and justified.

Static analysis

No suspicious patterns detected.