ClawHub
Back to skill

Security audit

小红书种草带货

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly a content workflow, but it also tells the agent to use stored login details and browser automation for a live creator account.

Review this skill before installing. Its content creation and review templates are ordinary, but the login section should be removed or treated as off-limits: do not let the agent read SECRET.md, handle phone numbers or passwords, autofill login forms, or operate an authenticated Xiaohongshu creator account. Use it only for drafting and audit support, with account login and publishing performed manually by the user.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:234
Finding

External Secret-File Access and Automated Credential Entry Exceed Least Privilege

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 234–237
Vulnerability Type: Unauthorized access to sensitive login information and unnecessary browser automation
Risk Level: Medium

Vulnerable Instruction

markdown
- **Login method**: Web login (https://creator.xiaohongshu.com)
- **Phone number**: 13308844548 (stored in ../main-conversation/SECRET.md)
- **Use agent-browser to fill it automatically**
- **Note**: When a verification code is required, call browser_wait_user_action

Technical Analysis

The Skill directs the Agent to access a sensitive file outside the Skill directory, retrieve personal login information, and enter that information into an external website through browser automation. It also embeds a personal phone number directly in the Skill instructions.

These actions exceed the minimum privileges required for the declared content-generation, review, and publication-preparation functionality. The Skill explicitly states that publication should be performed manually, so automated access to account credentials is unnecessary.

Referencing ../main-conversation/SECRET.md also crosses the Skill package boundary. If the Agent has filesystem access, this instruction could expose additional sensitive information present in that file, not merely the referenced phone number.

Attack Path

  1. A user invokes the publication-preparation workflow.
  2. The Agent loads the instructions in SKILL.md.
  3. The Agent follows the relative path to ../main-conversation/SECRET.md.
  4. Sensitive login information is read from outside the Skill directory.
  5. The Agent opens https://creator.xiaohongshu.com using browser automation.
  6. The Agent automatically enters the retrieved personal login information.
  7. The workflow pauses for user involvement only when a verification code is requested.
  8. If authentication succeeds, the browser session may obtain access to the associated creat ...[truncated 788 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the hardcoded phone number from SKILL.md.
  2. Remove all references to ../main-conversation/SECRET.md and prohibit the Skill from reading files outside its own package.
  3. Do not permit the Agent to read, store, transmit, or automatically enter passwords, phone numbers, verification codes, session tokens, or other authentication data.
  4. Require the user to open the creator portal and complete authentication manually.
  5. Restrict the Skill to generating a publication package containing reviewed text, images, tags, and user-approved product links.
  6. Add an explicit boundary stating that the Skill must not log in, publish, modify account settings, or perform account actions.
  7. Store any genuinely necessary sensitive data in a managed secret store with explicit user authorization, narrow access controls, audit logging, and no exposure to content-generation prompts.
  8. Rotate or review any credentials associated with the disclosed phone number if the project has been shared outside its intended environment.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

Ssd 4

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The workflow starts as ordinary affiliate content assistance, then gradually transitions into instructions for platform login and browser-assisted action using stored credentials. This staged escalation is dangerous because it normalizes benign steps before introducing sensitive account operations, making unauthorized or insufficiently reviewed actions more likely.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The skill explicitly includes a phone number, references a secret file for credentials, and instructs the agent to use browser automation to fill login information on a live platform. That exceeds a content-generation workflow and creates a direct path for account access and platform actions, increasing the chance of credential misuse or unauthorized posting.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The skill exposes a real-looking phone number and instructs retrieval/use of credentials from a secret file without a strong privacy or consent boundary. Embedding sensitive authentication data in skill instructions materially increases the risk of credential disclosure, misuse, and unauthorized account access.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill claims manual publication as a core safety principle, but later directs automated browser-assisted login and form filling. This inconsistency can mislead reviewers and users about the actual scope of agent actions, making risky automation appear compliant.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The primary trigger phrases are broad and overlap with ordinary writing-assistance requests, which can cause the skill to activate unexpectedly in unrelated conversations. Overbroad activation is risky here because the skill contains later-stage instructions involving platform workflows and sensitive account handling.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The sub-workflow trigger is vague enough to match common conversational language, which may unintentionally launch a workflow branch. In a skill that progresses from benign drafting into publication preparation, accidental activation broadens exposure to unsafe or privacy-impacting behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This markdown file contains user-facing instructions and report formats only in Chinese, which can constitute a language/locale policy violation if the skill is expected to operate generally rather than as a clearly region-specific tool. The file does not state that Chinese is optional, user-selected, or required for a documented compliance reason.

Content

No source excerpt is available for this finding.