follow-xhs

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:58 AM UTC
• Version: 1.0.0

Overview

This skill does the advertised Xiaohongshu searching, but it also handles live session cookies, ships a populated session value, and includes risky anti-bot and unsafe configuration behavior that should be reviewed before installation.

Install only if you are comfortable giving this skill a Xiaohongshu session cookie and allowing authenticated scraping-style requests. Rotate or remove the shipped web_session value, avoid pasting reusable cookies into chat, pin and review dependencies, remove eval-based config parsing, and redact session cookies from logs before use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/request/web/config.json:2

Finding

Plaintext Authentication Credential Committed to the Project

Content

View full analysis

Vulnerability Details

File Location: scripts/request/web/config.json, lines 2-5
Vulnerability Type: Hardcoded authentication secret
Risk Level: High

Vulnerable Code

json

"web_session": {
  "value": "040069b3dee5723cd2f869e7f93b4be9a776c9",
  "description": "Xiaohongshu web_session cookie value (required)"
},

Technical Analysis

The project contains a populated Xiaohongshu web_session cookie in a tracked configuration file. This value is an authentication credential rather than a non-sensitive configuration parameter.

Anyone with access to the distributed project, repository history, build artifacts, backups, or package caches can extract the credential. If it has not expired or been revoked, it may be replayed against Xiaohongshu APIs to impersonate the associated authenticated session.

Storing the credential in plaintext also makes it available to local processes and users that can read the project directory. The supplied config.example.json already provides an appropriate location for documenting the expected format without distributing a real value.

Attack Path

1. An attacker downloads the project or obtains a copy of its source history.
2. The attacker reads scripts/request/web/config.json.
3. The attacker extracts the populated web_session value.
4. The attacker places the cookie in an HTTP client or another copy of this Skill.
5. If the session remains valid, requests are sent under the affected user's authenticated Xiaohongshu session.

Impact Assessment

Successful replay may provide the access granted to the affected Xiaohongshu session. The exact scope depends on server-side session permissions and validity, but it can include authenticated account data and authenticated API operations.

This issue does not grant operating-system privileges by itself. Its scope is the account represented by the exposed session and every environment in which copies of th ...[truncated 30 chars]

Remediation

View remediation

Remediation Suggestions

1. Immediately revoke or invalidate the exposed Xiaohongshu session.
2. Remove the populated value from the current tree and repository history.
3. Ship config.json with a null or empty value, or generate it locally during onboarding.
4. Add the runtime secret file to .gitignore and package exclusion rules.
5. Load the credential from a protected environment variable, operating-system credential store, or secret manager.
6. Restrict runtime configuration permissions to the owning user.
7. Add automated secret scanning to commits and release builds.
8. Document credential rotation and revocation procedures.

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/request/web/xhs_session.py:241

Finding

Authentication Session Cookie Disclosed in Application Logs

Content

View full analysis

Vulnerability Details

File Location: scripts/request/web/xhs_session.py, lines 241-259
Vulnerability Type: Sensitive information exposure through logs
Risk Level: High

Vulnerable Code

python

if "禁言" in msg_lower or "被禁言" in msg_lower:
    logger.warning(f"禁言 | {web_session} | {res_msg} | {logger_info}")
    raise session_exceptions.MutedError(res_msg)

elif "登录已过期" in res_text_lower or "登录超时" in msg_lower:
    logger.warning(f"掉线 | {web_session} | web_session 登录超时 | {logger_info}")
    raise session_exceptions.LoginTimeOut(res_msg)

elif "删除" in res_text_lower:
    logger.warning(f"笔记/评论被删除 | {logger_info}")
    raise session_exceptions.TaskDeleteError(res_msg)

elif "无权限访问" in msg_lower:
    logger.warning(f"过期 | {web_session} | web_session 没有权限访问 | {logger_info}")
    raise session_exceptions.PermissionError(res_msg)

elif "违规情形" in msg_lower or "被封号" in msg_lower or "封号" in msg_lower:
    logger.warning(f"封号 | {web_session} | {res_msg} | {logger_info}")
    raise session_exceptions.BannedError(res_msg)

Technical Analysis

Several response-error branches interpolate the complete web_session cookie into warning logs. Authentication cookies are bearer credentials: possession can be sufficient to exercise the authenticated session without knowing the user's password.

Log data commonly has broader access and longer retention than secret storage. It may be written to terminal history, redirected files, debugging captures, centralized log platforms, support bundles, or CI artifacts. Consequently, even an otherwise protected runtime credential can be copied into less protected systems.

The error type and request metadata are sufficient for diagnosis. Including the raw session cookie is unnecessary for the Skill's declared search and reporting functionality and violates least-data principles.

Attack Path

1. The Skill runs with a valid web_session.
2. A response trigg ...[truncated 826 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove web_session from every log statement.
2. Log only the response status, sanitized error category, and non-sensitive request metadata.
3. If session correlation is necessary, use a short, non-reversible identifier rather than any cookie substring.
4. Introduce a centralized logging filter that redacts cookies, authorization headers, tokens, and configuration secrets.
5. Review existing logs and delete or restrict all records containing the credential.
6. Rotate credentials that may already have been logged.
7. Add tests asserting that captured logs never contain configured secret values.

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/request/web/encrypt/config.py:16

Finding

Arbitrary Python Evaluation of Encryption Configuration Values

Content

View full analysis

Vulnerability Details

File Location: scripts/request/web/encrypt/config.py, line 16
Vulnerability Type: Arbitrary code execution through unsafe configuration parsing
Risk Level: Critical

Vulnerable Code

python

def get(self, section: str, key: str, fallback=None):
    """
    Get a configuration item.
    """
    return eval(self.config.get(section, key, fallback=fallback))

Technical Analysis

The configuration accessor passes every value obtained from web_encrypt_config.ini directly to Python's eval(). Unlike a data parser, eval() can execute function calls, imports, attribute access, and arbitrary Python expressions.

Configuration values currently include strings, integers, lists, and dictionaries, but those data types do not require general-purpose code evaluation. If an attacker can modify the INI file before the Skill loads or accesses a setting, the attacker can replace an expected literal with an expression that performs operating-system actions.

The expression executes in the Skill process and inherits the Agent's filesystem, network, environment-variable, and account permissions. Configuration loading therefore becomes a local code-execution boundary.

Attack Path

1. An attacker gains write access to scripts/request/web/encrypt/web_encrypt_config.ini, or supplies a modified Skill package containing that file.
2. The attacker replaces a configuration value with a Python expression that invokes attacker-selected behavior.
3. The Skill imports xhs_config and requests the modified setting.
4. Config.get() passes the value to eval().
5. Python executes the expression with the privileges of the Agent process.

Impact Assessment

Successful exploitation provides arbitrary Python code execution under the operating-system identity running the Skill. This may allow reading or modifying accessible files, accessing environment variables and local credentials, in ...[truncated 294 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove eval() completely.
2. For existing literal-style values, use ast.literal_eval() as an interim measure.
3. Prefer explicit parsing by field:
   • ConfigParser.getint() for integers.
   • Explicit allowlists for enumerated strings.
   • JSON parsing for lists and dictionaries.
   • Strict URL validation for endpoint fields.
4. Define a schema containing the expected type and constraints for every configuration key.
5. Reject unknown sections, unknown keys, malformed values, and unexpected URL hosts.
6. Treat packaged configuration as read-only and verify package integrity where appropriate.
7. Add negative tests proving that Python expressions and function calls are rejected as data.

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unpinned Dependencies Installed During Onboarding

Content

View full analysis

Vulnerability Details

File Location: requirements.txt, lines 1-5; skill.md, lines 31-33
Vulnerability Type: Unverified and non-reproducible dependency installation
Risk Level: Medium

Vulnerable Code

requirements.txt:

text

aiohttp
loguru
pycryptodome
getuseragent
pydantic

skill.md:

text

Attempt to import aiohttp, loguru, pycryptodome, getuseragent:
- If successful: report that all dependencies are installed.
- If unsuccessful: execute pip install aiohttp loguru pycryptodome getuseragent, then report the result.

Technical Analysis

The dependency file does not pin versions or provide integrity hashes. The onboarding instructions also direct the Agent to install package names from the active pip index without constraining versions, verifying hashes, or confirming a trusted source.

This produces non-reproducible installations and allows dependency behavior to change after the Skill has been audited. Risk arises if a future package release, package index, mirror, DNS path, or local pip configuration is compromised. Python packages can execute installation or imported runtime code with the privileges of the Agent process.

The audit did not establish that the currently named packages are malicious. The confirmed issue is the unsafe dependency-resolution and installation process.

Attack Path

1. A required import fails during onboarding.
2. The Skill instructs the Agent to invoke pip with unconstrained package names.
3. Pip resolves packages using the current index and local pip configuration.
4. A compromised or maliciously replaced distribution is selected because no approved version or hash is enforced.
5. Package installation or subsequent import executes attacker-controlled code with the Agent's privileges.

Impact Assessment

A successful supply-chain compromise can result in arbitrary code execution under the identity running pip or the Skill. ...[truncated 357 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every direct and transitive dependency to reviewed versions in a lock file.
2. Use hash-verified installation, such as pip install --require-hashes.
3. Generate dependencies through a reproducible workflow and review updates before release.
4. Configure an explicitly trusted package index or controlled internal mirror.
5. Require informed user approval before installing packages.
6. Install into an isolated virtual environment with minimal filesystem and network privileges.
7. Run dependency vulnerability and provenance checks in CI.
8. Keep dependency installation separate from ordinary Skill execution.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (62)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description focuses on searching Xiaohongshu notes, obtaining note details, and producing analysis reports. However, the supplied code does not search notes or fetch note content; it calls an authenticated endpoint to get the current user's own basic account information. Accessing self-profile/account data is a distinct capability not reflected in the description, so this is a material description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The supplied code clearly supports Xiaohongshu note search and note detail retrieval, which matches much of the description. However, it also includes an undeclared capability to retrieve a specific user's posted notes via the user_posted endpoint, which goes beyond the stated purpose of note search/detail acquisition. Conversely, the description claims the tool can generate structured analysis reports, but no reporting or analysis-generation logic appears in this code chunk. Because the actual behavior both omits a declared core capability and includes an additional content-enumeration capability, this is a meaningful description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The declared description presents a user-facing Xiaohongshu content search and analysis tool. However, the supplied code chunk is only a configuration helper that reads a local file named web_encrypt_config.ini and exposes a get() method that evals retrieved values. This is a supporting/internal utility rather than implementation of the declared core functionality. Because the actual code does not demonstrate the stated primary purpose and instead performs unrelated config parsing behavior, this chunk is a mismatch with the declared description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description presents a content-oriented Xiaohongshu search and note analysis tool. However, this code chunk does not search notes, retrieve content, or generate reports. Instead, it creates a1 and webId values used for cookies/request identity, which is a request-encryption or session-support capability. That is a materially different function from the declared user-facing purpose and is not disclosed in the description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description says the skill searches Xiaohongshu notes, retrieves note details, and generates analysis reports. However, the provided code does none of those user-facing content operations. Instead, it parses JavaScript-provided security data, decodes base64 content, and reconstructs a websectiga value associated with Xiaohongshu's shield/webprofile and scripting security endpoints. This is a materially different capability focused on platform security/anti-bot token derivation rather than content search or analysis. Therefore the code chunk does not accurately match the declared purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description says the skill searches Xiaohongshu notes, retrieves note details, and generates structured analysis reports. The supplied code does none of those things. It is a standalone decoding utility for an encoded parameter/value, using a custom Base64 alphabet plus URL decoding and JSON parsing. While such a helper could support a larger scraping or retrieval pipeline, this chunk’s actual behavior is materially different from the declared end-user functionality and exposes an undeclared capability: deobfuscating encoded data. Therefore this code chunk does not accurately represent the declared purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description says the skill searches Xiaohongshu notes, retrieves note details, and produces structured analysis reports. However, this code chunk does none of those user-facing content operations. Instead, it builds a large fingerprint object with many browser/environment fields (x1-x80), randomizes hardware/screen/WebGL characteristics, includes cookies and navigation context, and updates the fingerprint for later requests. This is materially different from search/content retrieval/report generation and represents an undeclared capability related to request spoofing or anti-bot evasion. While such functionality could be a supporting implementation detail for scraping Xiaohongshu, the description does not mention fingerprint generation or risk-relevant anti-detection behavior, so this is a meaningful description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The declared description presents a user-facing content search and note retrieval/reporting tool. However, the supplied code chunk does not implement searching, fetching note content, or generating analysis reports. Instead, it aggregates low-level encryption/signing modules used to construct Xiaohongshu web request cookies, headers, and fingerprints. While such functionality could support a scraper or search tool, this chunk's actual purpose is materially different and undeclared, so it should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The declared description presents an end-user content retrieval and analysis tool. However, the supplied code chunk is a configuration manager: it reads/writes config.json, exposes getters for session/search/proxy/rate-limit settings, and supports updating the config file. While configuration support could be part of a larger search tool, this chunk by itself does not implement the core declared behaviors of searching Xiaohongshu, retrieving note details, or generating analysis reports. It also performs local file persistence for configuration, which is not reflected in the description. Therefore this chunk does not accurately match the declared purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

声明描述的是一个面向“搜索笔记和获取内容并分析”的高层工具；而这段代码的实际职责是底层的小红书会话与反爬/认证请求封装。它会访问认证与安全相关接口，设置 a1、webId、websectiga、sec_poison_id、web_session 等 cookie，生成 x-s、x-s-common、x-t 等签名头，并在遇到 461/471 等状态时触发扫码或滑块验证处理，甚至尝试自动登录。这些都是未在描述中体现的能力。虽然这些功能可能是搜索工具的支撑实现，但该代码块本身并没有体现“搜索笔记、获取笔记详情、生成分析报告”的核心行为，因此描述与该代码块实际行为存在明显不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description describes an end-user content search and analysis tool for Xiaohongshu. However, the supplied code chunk is only a generic response schema class used for formatting outputs. This is a supporting utility component, but by itself it does not perform any of the core declared functions. Because the actual code shown has a materially different immediate purpose than the declared skill behavior and lacks the claimed capabilities, this code chunk does not accurately represent the declared description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description presents a user-facing Xiaohongshu content search and analysis tool. However, the supplied code chunk contains only two generic bitwise shift functions and does not perform searching, content retrieval, note parsing, report generation, or any platform interaction. While helper utilities can support a larger system, this chunk’s behavior is unrelated enough to the stated primary purpose that it should be flagged as a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

There is a clear description-behavior mismatch. The declared purpose describes an application-level tool for searching Xiaohongshu notes, retrieving note details, and producing structured analysis. In contrast, the code chunk is a low-level utility module for data encoding and decoding. These functions may be supportive in some broader system, but on their own they do not implement or directly support the declared primary capability in any specific way visible here. No network access, content lookup, note extraction, or reporting logic is present.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

There is a clear description-behavior mismatch. The declared purpose is an application-level content search and analysis tool for Xiaohongshu notes, but the actual code chunk is a low-level utility module for computing hashes and checksums. These functions do not access Xiaohongshu, retrieve content, analyze notes, or generate reports. While such utilities could theoretically support another system, this chunk by itself reflects a materially different primary purpose from the declared description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description says this skill searches Xiaohongshu notes, retrieves note content, and produces structured analysis reports. The supplied code does none of that. It only implements a reusable singleton pattern helper, which is a generic programming utility and not a supporting detail that demonstrates the declared behavior. There are no network calls, search logic, content extraction, parsing, or reporting capabilities present in this code chunk. Therefore, the code chunk materially differs from the declared purpose.

Content

No source excerpt is available for this finding.

eval() call detected

High

• Category: Dangerous Code Execution
• Confidence: 99% confidence

Finding

The code passes configuration values directly into Python's eval(), which executes arbitrary Python expressions from the INI file. If an attacker can modify the configuration file or influence its contents, this becomes arbitrary code execution in the process context of the skill.

Content

Scanner excerpt · scripts/request/web/encrypt/config.py (reported line 16)May include surrounding context.

python

"""
        获取配置项的通用方法
        """
        return eval(self.config.get(section, key, fallback=fallback))

# 单例模式
xhs_config = Config()

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Evaluating configuration as code is inherently unsafe because configuration data is normally expected to be passive, not executable. This design can hide dangerous behavior and makes any compromise of the config file escalate into code execution without any explicit safety boundary.

Content

No source excerpt is available for this finding.

Obfuscated Code

High

• Category: Supply Chain
• Confidence: 50% confidence

Finding

Code contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.

Content

Scanner excerpt · scripts/request/web/encrypt/decrypt_xs_xsc.py (reported line 88)May include surrounding context.

python

# 使用示例
if __name__ == "__main__":
	# 假设这是编码后的p值
	encoded_p = "2UQAPsHC+aIjqArjwjHjNsQhPsHCH0rjNsQhPaHCH0c1Pjh9HjIj2eHjwjQgynEDJ74AHjIj2ePjwjQhyoPTqBPT49pjHjIj2ecjwjHFN0qEN0ZjNsQh+aHCH0rEw/HAwn+Y+Aqly9T64oGhyopdP0+hJnRU2oSl8BlD2gm92nQkqAbx+/ZIPeZl+eWEweqjNsQh+jHCHjHVHdW7H0ijHjIj2eWjwjQQPAYUaBzdq9k6qB4Q4fpA8b878FSet9RQzLlTcSiM8/+n4MYP8F8LagY/P9Ql4FpUzfpS2BcI8nT1GFbC/L88JdbFyrSiafp/cDMra7pFLDDAa7+8J7QgabmFz7Qjp0mcwp4fanD68p40+fp8qgzELLbILrDA+9p3JpH9LLI3+LSk+d+DJfpSL98lnLYl49IUqgcMc0mrcDShtMmozBD6qM8FyFSh8o+h4g4U+obFyLSi4nbQz/+SPFlnPrDApSzQcA4SPopFJeQmzBMA/o8Szb+NqM+c4ApQzg8Ayp8FaDRl4AYs4g4fLomD8pzBpFRQ2ezLanSM+Skc47Qc4gcMag8VGLlj87PAqgzhagYSqAbn4FYQy7pTanTQ2npx87+8NM4L89L78p+l4BL6ze4AzB+IygmS8Bp8qDzFaLP98Lzn4AQQzLEAL7bFJBEVL7pwyS8Fag868nTl4e+0n04ApfuF8FSbL7SQyrLUtASrpLS92dDFa/YOanS0+Mkc4FbQ4fSM+Bu6qFzP8oP9Lo4naLP78p+D+9pxcpPFaLp9qA++qDMFpd4panSDqA+AN7+hnDESyp8FGf+p8np8pd49ag88Gn+S8np/4g49/BEmqM+M4MmQ2BlFagYyL9RM4FRdpd4Iq7HFyBppN9L9/o8Szbm7zDS987PlqfRAPLzyyLSk+7+xGfRAP94UzDSbPBLALoz9anSjLDRl4FROqgziagYSq7Yc4A4QyrbSpSmFyrSiN7+8qgz/z7b72nMc4FzQ4DS3a/+Q4ezYzMPFnaRSygpFyDSkJgQQzLRALM8F2DQ6zDF6wg8Sy0Sy4DSkzLEo4gzCqdpFJrS94fLALozp/7mN8p88+g+nqBMTanYdqM8DPo+3Lozcqob7JFSePBLI4g4manTd8gYxLd4Q4fpSLAq68n8n4b+QPA4Ay7b74LEDLSmQyrYIaL+dq7Y+89p3GaRSnLc9qMSc4bbQyLF6a/+g/pkl4BbQPAzpanV98p4/qBlFy0pAPb8FqDS3pfSILoqMLBMw8n8gO/FjNsQhwaHCN/HM+AZM+eGUPaIj2erIH0iINsQhP/rjwjQ1J7QTGnIjKc=="

	# 解码
	decoded_p = decode_p(encoded_p)

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This module does more than ordinary content retrieval: it synthesizes a detailed browser fingerprint payload, including anti-automation and environment signals, to make scripted traffic appear like a real browser. In the context of a Xiaohongshu search/content tool, that is an anti-detection capability that materially enables stealth scraping and evasion of platform bot controls.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code explicitly spoofs browser fingerprint signals such as webdriver state, WebGL renderer, storage support, plugins, screen characteristics, and timing metadata. That capability is not necessary for legitimate search/report generation and instead serves to bypass anti-bot defenses, increasing the likelihood of unauthorized automated access and making abuse harder to detect.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The session initialization automatically attempts login via scan_login() whenever both sid and did are present, which exceeds the stated scope of a search/content-fetch tool. Embedding authentication and challenge-handling behavior into a retrieval utility increases the chance the skill will operate with elevated account privileges and perform unintended account actions without explicit user awareness.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

On NeedScanLogin, the code programmatically calls pass_scan_124(...) and then transparently replays the original request, effectively automating passage through a platform verification gate. This is dangerous because it turns a content-fetching skill into one that can bypass interactive anti-abuse controls and continue operating under authenticated account state with no explicit confirmation at the time of use.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill directs the agent to automatically run pip install on the local machine, which expands its capabilities by modifying the environment and executing package installation commands unrelated to simple search/report generation. This is dangerous because it enables unreviewed code retrieval and installation from external sources, creating supply-chain and arbitrary code execution risk on the user's host.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill explicitly asks the user to provide a live web_session login credential and stores it in configuration, adding credential collection and persistence beyond the core reporting purpose. Handling authentication secrets in chat and local config materially increases the risk of credential theft, replay, misuse of the account, and unauthorized access if logs or files are exposed.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The workflow solicits, saves, and operationally reuses a user's web_session credential through chat-driven configuration management, effectively turning the skill into a credential-handling system. Storing account secrets in config and conversational state creates substantial exposure to unauthorized reuse, leakage in logs/backups, and lateral misuse of the authenticated account.

Content

No source excerpt is available for this finding.