Security audit

xhsmander

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its Xiaohongshu automation purpose, but it exposes live account-control tooling through an unpinned Docker service with weak network and session boundaries.

Review before installing. Run only on a trusted machine, bind the MCP port to 127.0.0.1, pin and audit the Docker image, protect or delete ./data cookies and generated QR/result files, and require explicit confirmation before publishing, commenting, liking, or favoriting from a real account.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: docker-compose.yml:17
Finding: Unauthenticated Account-Control Service Exposed on All Host Interfaces
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: docker-compose.yml:1
Finding: Mutable and Unpinned Third-Party Container Image Executes Outside the Audited Codebase
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/get_qr.py:43
Finding: Login QR Artifacts and Complete Authentication Responses Persisted Without Restrictive File Handling
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (19)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description presents a concrete automation skill with multiple Xiaohongshu-related capabilities. However, the provided code chunk is effectively empty aside from a comment, so it does not demonstrate any of those behaviors. This is a material mismatch between the claimed purpose and the actual supplied implementation.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill advertises networked automation and file-writing behavior but does not declare any explicit tool scope or permission boundaries. In an agent setting, missing scope declarations can lead to overbroad invocation and unintended access to local files or external services without clear user consent.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The invocation text uses broad trigger phrases like publishing to Xiaohongshu, posting notes, login, and automation, which can overlap with ordinary user requests. That increases the chance the skill is auto-invoked in contexts where the user did not intend real account actions, especially because the skill can publish content and interact with a live platform.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill notes that cookies are stored in a Docker volume and QR/login artifacts are written locally, but it does not present this as an explicit user-facing warning near invocation or use. Storing session material on disk can expose account access if the host, mounted volume, or generated files are read by other users or processes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The tool list includes real account actions such as publishing, liking, favoriting, and commenting, but the skill description does not prominently warn that these cause irreversible or externally visible actions on a live Xiaohongshu account. In an agent environment, insufficient warning raises the risk of accidental spam, unwanted social actions, reputational damage, or account enforcement.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The API reference exposes tools that can directly publish content and perform engagement actions on an external Xiaohongshu account, but it does not include explicit user-facing warnings, consent expectations, or abuse-prevention guidance. In the context of an automation skill for social-media posting and interaction, this increases the risk of unintended account actions, spammy behavior, or misuse of a logged-in user's account.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The script writes login status data returned by the local MCP service to a fixed user-path JSON file without any notice, consent flow, or access control. Even if the data is "only" login state, it may contain account/session-related metadata or become a privacy leak on multi-user systems, and the fixed path makes the artifact predictable for other local processes to monitor or read.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The like and favorite commands require an xsec_token and pass it to backend tooling, but this file provides no warning that users are supplying a sensitive credential on the command line. Command-line arguments may be exposed via shell history or process listings, so some disclosure is warranted.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This code saves the full RPC result to a JSON file and decoded image bytes to a PNG file, which are file-write operations affecting local user data. Although there is a print after saving the image, there is no warning or confirmation before either write occurs, and no surrounding comment or docstring disclosing that local files will be created.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The module docstring and inline documentation are written only in Chinese, which imposes a specific language/locale on operators and maintainers without presenting any choice or justification in the file. Under the stated policy, language constraints should either be optional for the user or clearly documented as region-specific and necessary.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This code sends the caller-supplied arguments payload over HTTP to the MCP service via urllib.request.urlopen, but there is no visible warning, confirmation, or user-facing log that data provided to the skill will be transmitted to a local service. The docstrings only describe functionality and do not disclose the network transmission behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: This code file sends user-supplied content and image references to call_tool("publish_content", ...), which is a network-like or external publishing operation. Although the file's purpose is publishing, there is no explicit disclosure in the code about privacy implications, external transmission, or that the content will be posted remotely; the existing usage text only explains arguments.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The script performs a network-side effect (publishing content to the local MCP service, which in turn automates posting to Xiaohongshu) and then writes the response to a local file without any user-facing confirmation, warning, or runtime consent check. In an automation skill whose purpose is social-media posting, silent publication is especially risky because it can cause unintended account actions, reputation harm, and leakage of post metadata or results to disk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The comment explicitly recommends the Alibaba Cloud mirror for 'domestic users' and is written only in Chinese, indicating a locale-specific preference without offering a language or locale choice. Under the policy, locale constraints should be opt-in or clearly justified as region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 72% confidence
Finding: A language or locale policy issue can arise when a skill or its instructions force a specific language without user opt-in. This file presents all operational guidance only in Chinese and does not indicate that the language is optional or that the skill is intentionally limited to a Chinese-speaking context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The file contains a Chinese-only natural-language description ("检查登录状态") and provides no indication that language is configurable or user-selected. Per the policy, forcing a specific language without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The module docstring presents the CLI description and usage text only in Chinese, which can impose a fixed language on users without opt-in. Under the stated policy, locale-specific language should either be optional or clearly justified.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: This code saves authentication-related image data to a fixed file path on the local filesystem. While it prints the save location afterward, there is no pre-action warning, confirmation, or inline comment/docstring disclosure that the login QR code will be persisted as a file, which can matter for user privacy and shared-system safety.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The script fixes both the title and body content in Chinese and provides no mechanism for user language selection or opt-in. This is a natural-language policy concern because the skill behavior is locked to a specific locale/language rather than offering a choice.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.