follow-xhs

AdvisoryAudited by Static analysis on May 10, 2026.

Overview

Detected: suspicious.dynamic_code_execution, suspicious.install_untrusted_source

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ConcernHigh Confidence

ASI03: Identity and Privilege Abuse

What this means

The skill may use or expose an existing Xiaohongshu login session, and anyone receiving the package may inherit a credential that should not be shared.

Why it was flagged

The packaged config contains a non-placeholder Xiaohongshu session cookie value. SKILL.md describes web_session as a login credential, so shipping one creates account-access and credential-leak risk.

Skill content

"web_session": { "value": "040069b3dee5723cd2f869e7f93b4be9a776c9" }

Recommendation

Remove the bundled session value, rotate the exposed cookie, declare the credential requirement in metadata, and require each user to provide their own credential through a safer per-user secret mechanism.

ConcernHigh Confidence

ASI03: Identity and Privilege Abuse

What this means

Providing this value may allow the skill to act through the user’s Xiaohongshu web session and may expose the account to rate limits, verification challenges, or account-security issues.

Why it was flagged

The skill explicitly asks for a raw login-session cookie and later saves it to config. This is high-impact account access, while registry metadata declares no primary credential or required environment variable.

Skill content

"web_session 是小红书的登录凭证，必须配置后才能使用搜索功能。"

Recommendation

Only provide a session cookie if you understand the account risk. The publisher should document the exact credential scope, storage location, retention, and revocation steps.

ConcernHigh Confidence

ASI05: Unexpected Code Execution

What this means

A tampered configuration file could run commands on the user’s machine under the agent’s privileges.

Why it was flagged

The config parser evaluates configuration values as Python code. If the config file is altered, importing or using the encrypt module could execute arbitrary local code.

Skill content

return eval(self.config.get(section, key, fallback=fallback))

Recommendation

Replace eval with ast.literal_eval or JSON parsing, and treat configuration as data rather than executable Python.

NoteHigh Confidence

ASI04: Agentic Supply Chain Vulnerabilities

What this means

The agent may modify the local Python environment and fetch current package versions from PyPI.

Why it was flagged

The skill may install unpinned Python packages during onboarding despite having no install spec. These dependencies are relevant to the stated function, but the install path is under-declared.

Skill content

如果失败：执行 `pip install aiohttp loguru pycryptodome getuseragent`

Recommendation

Install dependencies in a virtual environment, pin versions in requirements.txt or an install spec, and review packages before installation.

NoteMedium Confidence

ASI02: Tool Misuse and Exploitation

What this means

Using a logged-in session with generated request signatures may trigger platform risk controls or affect the user’s Xiaohongshu account session.

Why it was flagged

The implementation generates custom Xiaohongshu web API signing headers. This appears related to search/detail retrieval, but users should understand it is using raw web API mechanics rather than a simple official export flow.

Skill content

用于生成小红书API请求所需的X-S加密头

Recommendation

Use a dedicated low-risk account where possible, keep request volume low, and ensure the skill clearly documents its API behavior and limits.

NoteMedium Confidence

ASI09: Human-Agent Trust Exploitation

What this means

A user may underestimate that search keywords, request metadata, and session-authenticated traffic go to Xiaohongshu services.

Why it was flagged

The code may run locally, but the skill necessarily sends requests to Xiaohongshu APIs using a session cookie. Users should not interpret this wording as meaning no data leaves the machine.

Skill content

这个 skill 完全在你的本地机器上运行。

Recommendation

Clarify that execution is local but network requests are sent to Xiaohongshu, and explain what data is transmitted.

Findings (3)

critical

suspicious.dynamic_code_execution

Location: scripts/request/web/encrypt/config.py:16
Finding: Dynamic code execution detected.

warn

suspicious.install_untrusted_source

Location: scripts/request/web/config.example.json:19
Finding: Install source points to URL shortener or raw IP.

warn

suspicious.install_untrusted_source

Location: scripts/request/web/config.json:19
Finding: Install source points to URL shortener or raw IP.