ClawHub
Back to skill

Security audit

Xiaohongshu Browser

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to perform Xiaohongshu browsing as described, but it stores reusable login state locally, including an extra undocumented auth file, so users should review it carefully before installing.

Install only if you are comfortable with this skill saving Xiaohongshu login state on your machine. Protect ~/.openclaw/xhs_data and ~/.openclaw/xhs_auth.json like credentials, avoid shared machines or synced backup folders, and delete both if you want to clear the session. Prefer pinned Playwright/Chromium versions in controlled environments.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:23
Finding

Unpinned Playwright and Chromium Dependencies

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:23-24
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code:

bash
pip install playwright
playwright install chromium

Technical Analysis

The installation procedure retrieves the latest available Playwright package and its associated Chromium binary without pinning an audited version or verifying artifact integrity. Consequently, the code and browser revision installed by these commands can change after the skill has been reviewed.

If the package index, publisher account, dependency distribution channel, or downloaded browser artifact is compromised, following these instructions could install and execute attacker-controlled code. Python packages may execute code during installation, while compromised browser components would execute when either included script launches Chromium.

Attack Path

  1. An attacker compromises the Playwright distribution account, package index, dependency chain, or Chromium download infrastructure.
  2. The attacker publishes or substitutes a malicious package or browser artifact under the expected dependency name.
  3. A user follows the documented commands without specifying a trusted version or validating hashes.
  4. The malicious component is installed under the user's account.
  5. Attacker-controlled code executes during installation or when the skill launches Playwright and Chromium.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the user installing or running the skill. This could expose local files, browser data, Xiaohongshu authentication state, and any other resources available to that user. The issue does not independently provide elevated system privileges, but its scope may include the entire user account.

Remediation
View remediation

Remediation Suggestions

  • Pin Playwright to a specific, reviewed version rather than installing the latest release.
  • Maintain dependencies in a lock file and verify Python package hashes using a hash-enforcing installation workflow.
  • Document and pin the expected Playwright-managed Chromium revision.
  • Use only trusted package indexes and browser download sources.
  • Review and deliberately update dependency versions instead of accepting automatic upstream changes.
  • Consider distributing a reproducible environment or verified container image with dependency checksums recorded.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/xhs_open.py:10
Finding

Redundant Plaintext Export of Authenticated Browser State

Content
View full analysis

Vulnerability Details

File Location: scripts/xhs_open.py:10-29
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Medium

Vulnerable Code:

python
AUTH_FILE = str(OPENCLAW / "xhs_auth.json")

CTRL.unlink(missing_ok=True)

pw = sync_playwright().start()
browser = pw.chromium.launch_persistent_context(
    USER_DATA,
    headless=False,
    viewport={"width": 1280, "height": 900},
    locale="zh-CN",
)

page = browser.pages[0] if browser.pages else browser.new_page()
page.goto("https://www.xiaohongshu.com", wait_until="domcontentloaded", timeout=60000)
print("BROWSER_READY", flush=True)

while not CTRL.exists():
    time.sleep(1)
CTRL.unlink(missing_ok=True)

browser.storage_state(path=AUTH_FILE)

Technical Analysis

After manual login, the script exports Playwright storage state to ~/.openclaw/xhs_auth.json. Storage-state files can contain authenticated cookies and origin storage that may function as reusable session credentials.

The script does not explicitly enforce owner-only permissions on the exported file. Its effective permissions therefore depend on the operating system, directory permissions, existing file state, and process umask. The search script does not read this JSON file; it instead launches Chromium using the persistent profile at ~/.openclaw/xhs_data. The export consequently creates an additional credential-bearing artifact without being required for the documented search workflow.

The documentation states that login state is stored in ~/.openclaw/xhs_data but does not disclose the additional xhs_auth.json export. This can cause users to overlook the file when securing, backing up, or deleting authentication data.

Attack Path

  1. A user runs xhs_open.py and authenticates to Xiaohongshu.
  2. When the control file appears, the script exports the authenticated storage state to ~/.openclaw/xhs_auth.json.
  3. A local process ...[truncated 921 chars]
Remediation
View remediation

Remediation Suggestions

  • Remove the browser.storage_state(path=AUTH_FILE) export because the current search workflow uses the persistent browser profile and does not consume this file.
  • If a separate storage-state file is required, create ~/.openclaw with owner-only directory permissions and enforce owner-read/write permissions on the resulting file.
  • Write sensitive state securely, avoid following symbolic links, and reject pre-existing files with unexpected ownership or type.
  • Store only the minimum authentication state necessary and delete it immediately when it is no longer needed.
  • Update the documentation to identify every location containing authentication material.
  • Provide instructions for deleting both the persistent browser profile and any exported storage-state file.
  • Recommend revoking active sessions through Xiaohongshu if an authentication-state file may have been exposed.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.

md
# Windows:
Remove-Item -Recurse -Force "$env:USERPROFILE\.openclaw\xhs_data"
# Linux / macOS:
rm -rf ~/.openclaw/xhs_data

# 2. 重新运行登录脚本
python <skill_dir>/scripts/xhs_open.py

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.

md
# Windows:
Remove-Item -Recurse -Force "$env:USERPROFILE\.openclaw\xhs_data"
# Linux / macOS:
rm -rf ~/.openclaw/xhs_data

# 2. 重新运行登录脚本
python <skill_dir>/scripts/xhs_open.py

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill clearly relies on networked browser automation to access Xiaohongshu, but it declares no explicit tool scope or permissions. Missing scope boundaries can cause agents or operators to underestimate what the skill is allowed to do, increasing the risk of unintended web access or misuse in environments that depend on manifest restrictions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill instructs users to persist authenticated Xiaohongshu session state under a local directory without clearly warning that these files may contain reusable authentication material. If another local user, process, or backup system accesses that directory, the saved session could be reused to impersonate the user.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The code hard-codes locale="zh-CN" for the browser context, which imposes a specific language/locale behavior on all users. This is a natural-language policy concern because there is no visible opt-in, fallback, or justification that the skill is intended only for a Chinese-locale workflow.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The browser context is hard-coded with locale="zh-CN", which imposes a specific language/locale behavior on all runs. This is a natural-language policy concern because the file does not offer user opt-in or document why the locale restriction is required.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The markdown instructs users to run Remove-Item -Recurse -Force or rm -rf against the Xiaohongshu data directory. Although the purpose is implied, there is no explicit warning that this permanently deletes the saved login/session data and forces re-authentication.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

The note at L124 says the skill uses a headless browser and will not open a window. However, the documented login procedure at L034-L040 explicitly states that running the login script will pop up a browser window and requires the user to log in manually there. This is a direct contradiction in the skill's own documentation about how it operates.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn
Code
suspicious.destructive_delete_command
Location
SKILL.md:99