IceCube Xiaohongshu Flow

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:54 AM UTC
• Version: 1.0.0

Overview

This skill openly automates Xiaohongshu publishing, but it asks users to run an unverified third-party binary tied to a logged-in account and leaves a background service available for posting.

Review this skill carefully before installing. Only use it if you trust the third-party Xiaohongshu MCP binary and are comfortable granting it access to your Xiaohongshu session. Pin and verify the binary, run the service only when needed, stop it with a verified PID, and require manual review before publishing posts, sending private-message replies, writing activity logs, or routing followers to WeChat or paid offerings.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:130

Finding

Unpinned Remote Binary Retrieval and Execution

Content

View full analysis

mcp.log 2>&1 & echo $! > mcp.pid ``` ### Technical Analysis The deployment procedure downloads the current release artifact matching a mutable filename from an external GitHub repository and immediately extracts and executes its binaries. It does not pin an immutable release version or commit, verify a cryptographic checksum, validate a digital signature, or build from audited source. Consequently, the code executed by users may differ from the artifact that existed when this Skill was reviewed. Compromise of the upstream repository, release account, release workflow, or distributed archive would allow an attacker to substitute arbitrary executable code. Running the login binary is particularly sensitive because it participates in account authentication and may have access to Xiaohongshu session material. ### Attack Path 1. An attacker compromises the upstream repository, release credentials, or release pipeline. 2. The attacker replaces the matching release archive with a modified archive containing malicious binaries. 3. A user follows the Skill instructions and runs `gh release download` without selecting an immutable version. 4. The archive is extracted without integrity or authenticity verification. 5. The user executes the modified login binary and starts the modified ...[truncated 718 chars]

Remediation

View remediation

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:354

Finding

Embedded Off-Platform Traffic-Diversion and Promotional Instructions

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:290

Finding

Unsafe Process Termination Based Solely on a Network Port

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill is designed to publish content to an external platform and write records to local storage, yet it provides no requirement for explicit user confirmation before posting or modifying files. In an agent setting, this can cause unintended external actions, account misuse, or silent persistence of user/activity data.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 87% confidence

Finding

The skill instructs downloading and installing a third-party MCP binary that is then used with an authenticated Xiaohongshu account. Persisting such tooling locally increases the trust and session surface: a compromised or replaced binary could retain credentials, automate posting, or act on the user's account outside the immediate session.

Content

Scanner excerpt · SKILL.md (reported line 132)May include surrounding context.

首次部署：

bash

# 1. 下载 MCP 服务
mkdir -p ~/xiaohongshu-mcp/bin
gh release download --repo xpzouying/xiaohongshu-mcp \
  --pattern "xiaohongshu-mcp-darwin-arm64.tar.gz" --dir /tmp
tar -xzf /tmp/xiaohongshu-mcp-darwin-arm64.tar.gz -C ~/xiaohongshu-mcp/bin/

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 91% confidence

Finding

Starting the MCP service via nohup in the background creates a persistent authenticated process beyond the immediate user interaction. A long-lived background service expands the window for misuse, can survive context boundaries, and may continue exposing local APIs tied to the user's Xiaohongshu session.

Content

Scanner excerpt · SKILL.md (reported line 143)May include surrounding context.

3. 启动 MCP 服务（后台）

cd ~/xiaohongshu-mcp nohup ./bin/xiaohongshu-mcp-darwin-arm64 > mcp.log 2>&1 & echo $! > mcp.pid

text

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.

服务验证：

bash

curl -s -X POST http://localhost:18060/mcp \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"openclaw","version":"1.0"}},"id":1}'

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 91% confidence

Finding

The service-management instructions again normalize running a persistent background MCP daemon tied to a logged-in publishing account. In skill context, this is more dangerous because the whole workflow is designed to automate external posting, so a persistent local API materially increases the chance of unintended or unauthorized account actions.

Content

Scanner excerpt · SKILL.md (reported line 289)May include surrounding context.

bash

# 启动服务
cd ~/xiaohongshu-mcp
nohup ./bin/xiaohongshu-mcp-darwin-arm64 > mcp.log 2>&1 &

# 停止服务
kill $(lsof -ti:18060)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

The skill writes publication records into persistent local memory files without disclosure or retention controls. Even if the stored fields appear simple, persistent records of titles, timestamps, and activity can leak behavioral data, create an audit trail the user did not expect, and normalize silent file modification by the agent.

Content

Scanner excerpt · SKILL.md (reported line 306)May include surrounding context.

bash

# 创建发布记录
mkdir -p ~/.openclaw/workspace/memory/xiaohongshu

# 写入发布记录
echo "## 发布记录 — $(date +%H:%M)" >> ~/.openclaw/workspace/memory/xiaohongshu/$(date +%Y-%m-%d).md

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The monetization and lead-generation section expands the skill from simple Xiaohongshu publishing automation into funneling users toward private messages, external groups, and paid offerings. This broadens the data-handling and social-engineering surface without any consent, trust, or privacy safeguards, making misuse more likely and creating functionality unrelated to the declared core publishing purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The marketing flow instructs routing people into private messages, WeChat groups, and paid channels without warning about privacy implications or handling of personal contact data. This creates an undisclosed collection and redirection path that could expose users to spam, unwanted outreach, or improper data processing.

Content

No source excerpt is available for this finding.