xhs-content-creator

• Outcome: Review
• Latest audit: Aug 4, 2026 · 1:37 PM UTC
• Version: 1.0.1

Overview

The skill is a real Xiaohongshu publishing automation tool, but it needs Review because it uses stealth-style browser automation and stores sensitive login and run artifacts.

Install only if you are comfortable giving this skill cloud-based control of an authorized Xiaohongshu session. Use draft mode by default, restrict who can see login QR codes, protect or regularly delete runtime/browser-profile and runtime/runs, and review the stealth automation behavior before using it on a real account.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (25)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill declares no permissions while the documented workflow clearly requires file read/write, shell execution, and network/browser automation. This undermines user and platform visibility into the skill’s effective capabilities, increasing the risk of over-privileged execution and making it harder to apply policy controls or informed consent.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: The declared purpose emphasizes content creation, but the skill also performs high-risk browser automation, login-state persistence, QR-based account access handoff, and extensive audit/log capture. This mismatch can mislead users and reviewers about the real security and privacy impact, especially because the undisclosed behavior includes account-affecting actions and storage of sensitive operational artifacts.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: This code deliberately alters browser-identifiable properties such as navigator.webdriver, window.chrome, plugins, and languages to evade automation detection rather than simply automate a browser. In a content-publishing skill, this exceeds normal functional needs and can facilitate stealthy interaction with third-party platforms in ways that bypass platform safeguards or user expectations.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The audit hooks log publishing-related request metadata, POST bodies, and some response bodies, which can include draft content, account identifiers, tokens, upload metadata, or server error details. This creates a sensitive data collection channel beyond what is needed to publish content and increases the risk of credential leakage, privacy exposure, or unintended retention of user data.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The file explicitly implements an anti-fingerprinting layer and states its goal is to make Playwright sessions indistinguishable from organic browsing. This exceeds ordinary content publishing automation and introduces stealth/evasion capability that can be used to bypass platform detection, abuse trust controls, or violate anti-bot protections.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The warm_path routine performs pretext browsing to the homepage, scrolls, and returns specifically to create a believable referer chain and browsing history before publishing. That behavior is not necessary for normal posting and is designed to disguise automation signals, increasing the risk of platform evasion and deceptive activity.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The code deliberately performs a homepage visit and scrolling 'warm_path' to build a realistic referer chain before publishing, alongside broader human-behavior simulation imports. That is anti-detection/evasion logic rather than functionality strictly required for content publishing, and it increases the risk that the skill is used to bypass platform abuse controls or Terms-of-Service enforcement.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: This section invokes private component methods such as host._onPublish and injects synthetic pointer/mouse events deep into the DOM/shadow DOM to force a publish action even when normal selectors fail. That bypasses intended UI boundaries and safety checks, making the automation more capable of defeating platform controls or triggering unintended publication under fragile page conditions.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: This script explicitly validates browser stealth characteristics such as navigator.webdriver removal, window.chrome shims, Playwright trace cleanup, spoofed Chrome UA/client hints, and locale/plugin fingerprints. In the context of a 小红书 content publishing skill, anti-detection validation is not necessary for normal content creation and is reasonably interpreted as enabling evasion of platform bot/fraud detection, which can facilitate abusive automation or account bans.

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The comment says the script avoids accessing XHS risk controls, but the subsequent checks still measure whether the browser successfully conceals automation artifacts. That mismatch indicates awareness of platform detection concerns and preserves functionality aimed at evasion, which increases the likelihood of deceptive or policy-violating automation.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The README explicitly states that persistent browser profiles, login state, screenshots, DOM snapshots, and run artifacts are retained locally, but it does not clearly warn that these files may contain sensitive account/session data, personal content, and page metadata. In this skill’s context, the retained data is especially sensitive because it automates a live social-media account via a persisted Chromium profile on a cloud/server environment, increasing the risk of account takeover or privacy leakage if the host is shared or compromised.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The README describes an end-to-end publishing pipeline and notes that the tool can create a draft or actually publish, but it does not prominently warn that using a non-draft mode can post directly to a real authorized account. In an automation skill connected to a cloud runner and agent-triggered workflow, this omission can cause unintended live posting, reputational harm, or accidental disclosure if users assume all runs are safe drafts.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill states that a QR code image may be sent to a Feishu group during login handoff, but it lacks an explicit user-facing warning in the description or consent gate. QR login artifacts can enable account access or expose sensitive session initiation data to unintended recipients if the group is misconfigured, over-broad, or monitored.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The document states that `MODE=publish` will trigger a real publish, but it does not present this as a prominent safety warning or require an explicit confirmation step before use. In a content-publishing skill, unclear deployment/run instructions can cause accidental live posting to a real social-media account, creating operational, reputational, and compliance risk.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The document explicitly instructs operators to forward a live login QR code image to a Feishu group, but it provides no access-control, audience restriction, expiration, or sensitivity warning. A login QR code is effectively an authentication artifact; if posted to a group with unintended members or retained in chat history, unauthorized users may scan it and take over the target session.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The document instructs the agent to forward a login QR code image and caption into a Feishu group, but does not warn that anyone with access to that group may be able to scan or view the authentication challenge. In this skill’s context, the QR code is part of an active login flow for a browser session that can publish on behalf of the user, so sending it to a group materially increases the chance of unauthorized account access or accidental disclosure.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: This code persistently captures full-page screenshots and raw DOM content and writes them to disk without any built-in consent, minimization, redaction, or retention controls. In the context of an automation skill that processes social-media posting workflows, those artifacts can easily contain sensitive user content, session data, drafts, account information, or private messages, creating a privacy and data-exposure risk if the run directory is accessed by unauthorized parties.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The request hook records POST payloads for selected URLs without any indication in this file of notice, consent, or minimization. Because publishing workflows commonly send user-authored text, media metadata, and authentication-related fields, this logging can expose sensitive user and account data to whoever can access the audit sink.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The code initiates external navigation to xiaohongshu.com automatically from within a helper without any visible consent or disclosure mechanism in this file. In combination with the stealth-oriented design, this increases the chance of unexpected third-party interactions and reduces user awareness of what the automation is doing on their behalf.

Natural-Language Policy Violations

High

• Confidence: 99% confidence
• Finding: The docstring openly states that the goal is to make automated sessions indistinguishable from organic human activity. That is a strong indicator of intentional stealth automation, which is dangerous because it is directly aimed at frustrating detection, review, and enforcement mechanisms on the target platform.

Ssd 4

Medium

• Confidence: 94% confidence
• Finding: The sequence of visiting the homepage, dwelling, scrolling, and then publishing is a narrative designed to fabricate normal browsing behavior before a sensitive action. This creates a deception layer around the publish workflow and can help evade heuristic anti-abuse systems that look for direct bot-like posting patterns.

Ssd 2

Medium

• Confidence: 96% confidence
• Finding: The code frames anti-detection behavior as benign human-like assistance, but the stated objective is still stealth. This kind of euphemistic packaging is risky because it normalizes evasion features and can hide the true security and policy implications from maintainers or users.

Credential Access

High

• Category: Privilege Escalation

Content

# Optional .env at PROJECT_ROOT (still respected if present for back-compat,
# but the caller in generate_and_publish.py already passes MODE explicitly).
if [ -f "${PROJECT_ROOT}/.env" ]; then
  # shellcheck disable=SC1091
  set -a
  . "${PROJECT_ROOT}/.env"

• Confidence: 81% confidence
• Finding: Sourcing ${PROJECT_ROOT}/.env executes the file as shell code, not merely parses key=value pairs. If an attacker can modify the repository, project root, or deployment artifacts, they can achieve arbitrary command execution in the context of this script and exfiltrate secrets from the environment. In an automation/publishing skill, this is more dangerous because it likely runs unattended with access to account credentials and content pipelines.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

playwright>=1.44
requests>=2.31

• Confidence: 95% confidence
• Finding: The dependency is specified with only a lower bound (`playwright>=1.44`), which makes builds non-reproducible and allows future major or minor releases to be installed without review. That can introduce supply-chain risk, unexpected breaking changes, or newly introduced vulnerabilities into an automation skill that interacts with external services.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

playwright>=1.44
requests>=2.31

• Confidence: 98% confidence
• Finding: `requests>=2.31` is unpinned, so installations may resolve to different versions over time, weakening reproducibility and increasing supply-chain exposure. In a skill that likely performs network operations and may handle authenticated publishing workflows, unexpected dependency changes can affect transport security or introduce exploitable behavior.

Static analysis

No suspicious patterns detected.