ClawHub
Back to skill

Security audit

Xiaohongshu Publish

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent Xiaohongshu publishing purpose, but it asks users to install and run an unverified third-party binary that can use account cookies and publish publicly.

Install only if you trust the GitHub release source and are comfortable giving the binary access to your Xiaohongshu login session and public posting flow. Prefer verifying a pinned release checksum or building from reviewed source, use a dedicated working directory, keep cookies.json protected, and preview every post before allowing publication.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:25
Finding

Unverified Remote Executables Are Downloaded, Installed, and Run with Account Access

Content
View full analysis
Remediation
View remediation
" ARCHIVE="$(mktemp "${TMPDIR:-/tmp}/xhs.XXXXXX.tar.gz")" curl --fail --show-error --location \ --proto '=https' --tlsv1.2 \ --output "$ARCHIVE" \ "https://github.com/xpzouying/xiaohongshu-mcp/releases/download/${TAG}/xiaohongshu-mcp-darwin-amd64.tar.gz" printf '%s %s\n' "$EXPECTED_SHA256" "$ARCHIVE" | shasum -a 256 -c - ``` 4. **Stage and inspect archive contents** - Extract into a newly created temporary directory rather than directly into `~/.local/bin`. - Reject absolute paths, parent-directory traversal entries, symbolic-link surprises, unexpected filenames, and extra executables. - Confirm that only the two documented binaries are present before installation. 5. **Avoid silent replacement** - Do not use forced moves to overwrite existing executable files without explicit user approval. - Install versioned filenames and use an intentional, auditable activation step. - Record the installed version and verified digest. 6. ...[truncated 861 chars]

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill description and usage instructions are entirely framed around Chinese-language publishing to Xiaohongshu, with trigger phrases and content examples only in Chinese and no indication that the user can opt into another language. Under the policy, forcing a specific language without user choice is a natural-language locale violation unless the constraint is explicitly justified.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

The skill instructs users to download and install executable binaries from an external GitHub release via curl and then place them into ~/.local/bin without any checksum, signature, or publisher verification. Because these binaries handle login state and browser automation for publishing, a compromised release, hijacked repository, or MITM through the configured proxy could lead to arbitrary code execution and theft of Xiaohongshu session data.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

若缺失，从 GitHub release 下载 darwin-amd64 包解压：

bash
TAG="v2026.06.12.1403-5c43e3d"   # 以 https://github.com/xpzouying/xiaohongshu-mcp/releases 最新为准
curl -sSL -x http://127.0.0.1:56925 -o /tmp/xhs.tar.gz \
  "https://github.com/xpzouying/xiaohongshu-mcp/releases/download/${TAG}/xiaohongshu-mcp-darwin-amd64.tar.gz"
mkdir -p ~/.local/bin && tar -xzf /tmp/xhs.tar.gz -C ~/.local/bin
mv -f ~/.local/bin/xiaohongshu-mcp-darwin-amd64 ~/.local/bin/xiaohongshu-mcp

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

md
TAG="v2026.06.12.1403-5c43e3d"   # 以 https://github.com/xpzouying/xiaohongshu-mcp/releases 最新为准
curl -sSL -x http://127.0.0.1:56925 -o /tmp/xhs.tar.gz \
  "https://github.com/xpzouying/xiaohongshu-mcp/releases/download/${TAG}/xiaohongshu-mcp-darwin-amd64.tar.gz"
mkdir -p ~/.local/bin && tar -xzf /tmp/xhs.tar.gz -C ~/.local/bin
mv -f ~/.local/bin/xiaohongshu-mcp-darwin-amd64 ~/.local/bin/xiaohongshu-mcp
mv -f ~/.local/bin/xiaohongshu-login-darwin-amd64 ~/.local/bin/xiaohongshu-login
chmod +x ~/.local/bin/xiaohongshu-mcp ~/.local/bin/xiaohongshu-login

Session Persistence

Medium
Category
Rogue Agent
Confidence
65% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.

-bin "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome"
-headless=false -port ":18060"

text
- 用 **`run_in_background`** 方式运行该脚本，使 MCP 常驻（不要 nohup &，会被工具调用结束回收）。
- 本地 Chrome 会弹出真实窗口，发布时能看到实际操作，更可控、登录态稳定。

### 步骤④ 发布

Session Persistence

Medium
Category
Rogue Agent
Confidence
65% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 151)May include surrounding context.

-bin "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome"
-headless=false -port ":18060"

text
- 用 **`run_in_background`** 方式运行该脚本，使 MCP 常驻（不要 nohup &，会被工具调用结束回收）。
- 本地 Chrome 会弹出真实窗口，发布时能看到实际操作，更可控、登录态稳定。

### 步骤④ 发布

Static analysis

No suspicious patterns detected.