Xiaohongshu MCP Installer

• Outcome: Review
• Latest audit: May 29, 2026 at 9:34 PM UTC
• Version:
  1.0.0

Overview

This skill installs the intended Xiaohongshu MCP service, but it also makes persistent system changes, can kill unrelated local processes, and handles browser cookies with weak safeguards.

Install only if you trust the upstream xiaohongshu-mcp project and are comfortable with a persistent local background service. Review the installer before running it, avoid the cookie-import path unless you understand that pasted cookies can grant account access, confirm what is using port 18060 before allowing any kill behavior, and prefer a low-privilege or user-level service instead of a root/system-wide systemd setup.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (29)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 97% confidence
• Finding: The skill executes extensive shell operations including downloading binaries, killing processes, editing persistence mechanisms, and invoking privileged commands, yet it declares no corresponding permissions. This creates a transparency and consent gap: users or orchestrators may invoke a highly privileged installer without understanding its real capabilities.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The skill is presented as an installer, but it also performs login-state checks, QR-code retrieval, and cookie-import workflows. Expanding from installation into authentication handling broadens the trust boundary and increases the chance users disclose sensitive credentials to a skill they only expected to install software.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The cookie-import workflow requests raw browser cookies and persists them to disk as a JSON file, which is far broader than necessary for a basic installer. Raw session cookies can enable account takeover if exposed through logs, backups, local compromise, or accidental reuse.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The installer checks whether the configured port is busy and, if so, enumerates all PIDs bound to that port and sends SIGKILL. This does not verify process identity, ownership, or executable path, so any unrelated local service using port 18060 can be terminated during installation.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The generated watchdog script unconditionally kills whatever process is listening on port 18060 and restarts xhs-mcp. Because it runs repeatedly, it can continuously disrupt unrelated applications that happen to use the same port, creating a persistent denial-of-service condition on the host.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger phrases include very broad natural-language expressions such as '帮我搞个小红书', which could match casual requests that do not imply consent to install software or configure background services. In this skill, accidental invocation is especially risky because execution leads to downloads, service installation, persistence, and possible credential workflows.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The description advertises one-click installation but does not clearly warn that it will create launchd/systemd services, keep a process running in the background, and configure watchdog behavior. Omitting these persistent system changes reduces informed consent and can surprise users with durable modifications to their machine.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The cookie import section lacks any warning that the user is being asked to provide sensitive authentication material and that it will be written locally in plaintext. Because the cookies likely include active session tokens, this can directly expose account access to anyone or anything that can read the file.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: On Linux the script writes a systemd unit into /etc/systemd/system and enables/starts it with sudo without prompting the user for confirmation about persistence or privileged changes. This is risky because it installs long-lived autorun behavior at the system level, which is especially sensitive in an installer fetched from the network.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The script force-kills processes on the target port during startup without prior disclosure or user confirmation. Silent destructive behavior in an installer increases operational risk because it may terminate unrelated workloads and hide the cause from the user.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The watchdog silently kills port occupants and restarts the service, while also configuring periodic execution on macOS via crontab. Because this behavior persists beyond initial installation and is not prominently disclosed, it can repeatedly interfere with system operation without obvious user awareness.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The skill explicitly instructs users to paste raw browser cookie strings and then stores them as reusable session objects. This is dangerous because browser cookies often function as bearer tokens; anyone obtaining them may be able to impersonate the user without additional authentication.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

WantedBy=multi-user.target
EOFSYSTEMD

sudo systemctl daemon-reload
sudo systemctl enable xhs-mcp
sudo systemctl start xhs-mcp
echo "✅ systemd 服务已启动"

• Confidence: 92% confidence
• Finding: sudo

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

launchctl load ~/Library/LaunchAgents/com.openclaw.xhs-mcp.plist

# 重启服务（Linux）
sudo systemctl restart xhs-mcp

# 卸载服务
launchctl unload ~/Library/LaunchAgents/com.openclaw.xhs-mcp.plist 2>/dev/null

• Confidence: 78% confidence
• Finding: sudo

Session Persistence

Medium

• Category: Rogue Agent

Content

EOFWATCHDOG
chmod +x ~/xiaohongshu-mcp/watchdog.sh

# macOS: 添加定期检查到 crontab
(crontab -l 2>/dev/null | grep -v watchdog; echo "*/5 * * * * ~/xiaohongshu-mcp/watchdog.sh") | crontab -
echo "✅ 看门狗已配置（每5分钟检查一次）"
```

• Confidence: 95% confidence
• Finding: crontab (crontab -l 2>/

Session Persistence

Medium

• Category: Rogue Agent

Content

EOFSYSTEMD

sudo systemctl daemon-reload
sudo systemctl enable xhs-mcp
sudo systemctl start xhs-mcp
echo "✅ systemd 服务已启动"
```

• Confidence: 96% confidence
• Finding: systemctl enable

Session Persistence

Medium

• Category: Rogue Agent

Content

sleep 1

# 启动
nohup ./xhs-mcp server --port 18060 > ~/xiaohongshu-mcp/mcp.log 2>&1 &
sleep 3

# 验证

• Confidence: 86% confidence
• Finding: nohup

Session Persistence

Medium

• Category: Rogue Agent

Content

lsof -ti :$PORT | xargs kill -9 2>/dev/null
    sleep 2
    cd ~/xiaohongshu-mcp
    nohup ./xhs-mcp server --port $PORT >> ~/xiaohongshu-mcp/mcp.log 2>&1 &
    sleep 3
    if check; then
        echo "$(date '+%Y-%m-%d %H:%M:%S') 重启成功" >> "$LOG"

• Confidence: 88% confidence
• Finding: nohup

Session Persistence

Medium

• Category: Rogue Agent

Content

#### macOS — launchd plist

```bash
XHS_PLIST="$HOME/Library/LaunchAgents/com.openclaw.xhs-mcp.plist"
mkdir -p "$HOME/Library/LaunchAgents"

cat > "$XHS_PLIST" << 'EOFPLIST'

• Confidence: 91% confidence
• Finding: PLIST

Session Persistence

Medium

• Category: Rogue Agent

Content

#### macOS — launchd plist

```bash
XHS_PLIST="$HOME/Library/LaunchAgents/com.openclaw.xhs-mcp.plist"
mkdir -p "$HOME/Library/LaunchAgents"

cat > "$XHS_PLIST" << 'EOFPLIST'

• Confidence: 91% confidence
• Finding: plist

Session Persistence

Medium

• Category: Rogue Agent

Content

XHS_PLIST="$HOME/Library/LaunchAgents/com.openclaw.xhs-mcp.plist"
mkdir -p "$HOME/Library/LaunchAgents"

cat > "$XHS_PLIST" << 'EOFPLIST'
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">

• Confidence: 90% confidence
• Finding: PLIST

Session Persistence

Medium

• Category: Rogue Agent

Content

XHS_PLIST="$HOME/Library/LaunchAgents/com.openclaw.xhs-mcp.plist"
mkdir -p "$HOME/Library/LaunchAgents"

cat > "$XHS_PLIST" << 'EOFPLIST'
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">

• Confidence: 90% confidence
• Finding: PLIST

Session Persistence

Medium

• Category: Rogue Agent

Content

cat > "$XHS_PLIST" << 'EOFPLIST'
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>

• Confidence: 87% confidence
• Finding: plist

Session Persistence

Medium

• Category: Rogue Agent

Content

cat > "$XHS_PLIST" << 'EOFPLIST'
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>

• Confidence: 87% confidence
• Finding: PLIST

Session Persistence

Medium

• Category: Rogue Agent

Content

cat > "$XHS_PLIST" << 'EOFPLIST'
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>
    <string>com.openclaw.xhs-mcp</string>

• Confidence: 87% confidence
• Finding: plist

VirusTotal

65/65 vendors flagged this skill as clean.