Security audit
xiaohongshu-skills
Security checks for vulnerabilities and agentic risk
Overview
The skill's declared requirements omit important runtime needs (Chrome, Python environment, access to the user's home/profile and ability to control processes) and its instructions ask for sensitive inputs (phone numbers, SMS codes, cookies/QR images) — the pieces are plausible for an automation tool but the omissions and process-control ability are inconsistent and warrant caution.
What to consider before installing/using this skill: - The skill will run Python scripts locally and requires a working Python 3.11 environment plus a local Chrome installation (or CHROME_BIN). The registry metadata does not declare these — verify you have the runtime and that you're comfortable the skill can launch and control Chrome. - The skill will create and use persistent state under ~/.xhs (accounts.json, chrome-profile directories) and can restart/kill Chrome processes. If you have other services listening on the default CDP port (9222) this skill could interact with or terminate them. Consider running it in an isolated account, container, or VM. - The login flow asks you to provide sensitive input (phone number, SMS verification codes) and will produce/return QR images (data URLs). Only provide such secrets if you trust the source and understand that those inputs effectively grant the skill the ability to log into your account. - No install script is provided; the code included will execute as-is. Before running, inspect the Python files (especially scripts that handle networking, file I/O, or subprocesses) for any unexpected remote endpoints, obfuscated logic, or hardcoded credentials. The pre-scan found suspicious unicode-control characters in SKILL.md — review that file for hidden characters. - If you need to test, do so in a disposable environment (isolated VM or container) and with throwaway accounts first. Backup any existing ~/.xhs data. Monitor network activity and file writes during a test run. If you want, I can (1) list high-priority files to review manually, (2) scan the rest of the truncated source for hardcoded remote endpoints or suspicious code paths, or (3) suggest a safe step-by-step sandboxed way to try the skill.
SkillSpector findings are pending for this release.