Security audit

小红书发布前检测 · 笔记合规自查 · 标题·导流·AI声明

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local Xiaohongshu draft-checking tool with disclosed local file and wordlist use, and I found no hidden posting, network, persistence, credential access, or destructive behavior.

Before installing, also install and trust the xiaohongshu-prohibited-words dependency because this skill loads its parser locally. Use it as a local draft checker only: it does not publish content, does not verify images/video, and its judgment depends on the bundled platform rules and current wordlist quality.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The entire skill description is written in Chinese and does not indicate any option for other languages or an explicit user opt-in to a Chinese-only experience. Under the policy, forcing a specific language without choice or justification is a natural-language policy violation.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Natural-Language Policy Violations

Medium

Confidence: 87% confidence
Finding: The entire skill file is written only in Chinese and does not indicate any user language choice, opt-in, or locale constraint. Under the stated policy, natural-language content that effectively enforces a single language without user selection can be a language/locale policy violation.

Natural-Language Policy Violations

Medium

Confidence: 97% confidence
Finding: This shell script’s comments and usage text are written in Chinese, and its runtime output is also Chinese-only later in the file. Under the policy, forcing a specific language without user opt-in or a documented region-specific justification is a natural-language policy violation.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The script prints status banners and test results in Chinese, with no indication that the user can select another language. This is a policy concern because the file contains user-facing natural language that forces a locale without opt-in.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The inline comment at L071 says the skill documentation claimed support for XHS_WORDLIST, while the note at L071-L072 states the script previously never read that variable. This is an explicit documentation-versus-code contradiction relevant to the skill's stated local wordlist behavior and fail-closed guarantees.

Natural-Language Policy Violations

Low

Confidence: 92% confidence
Finding: This markdown file includes prominent natural-language instructions and status notes in Chinese, such as the release annotation and section heading, without indicating that the skill is intentionally Chinese-only or providing any language/locale choice. Under the policy rule for language/locale, forcing a specific language without opt-in can be a violation even in ancillary documentation.

Natural-Language Policy Violations

Low

Confidence: 92% confidence
Finding: The file’s natural-language instructions and examples are presented only in Chinese, which can constitute a language policy violation when no user opt-in or locale justification is provided. The content does not indicate that the skill is region-specific or that users may choose their preferred language.

Natural-Language Policy Violations

Low

Confidence: 82% confidence
Finding: Line L29 says the material is '全英文' and frames translation as the workaround, but does not present any option for a different language or note that the English-only constraint is justified. This is a natural-language locale policy concern because it normalizes a fixed language requirement without user choice.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/preflight.py:108

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/selftest.sh:77