Security audit

小红书

Security checks across malware telemetry and agentic risk

Overview

This XiaoHongShu toolkit mostly matches its scraping and interaction purpose, but it needs review because it can use account credentials for live actions and includes underdocumented engagement-simulation and unsafe credential-handling patterns.

Install only if you are comfortable giving a local automation tool access to a XiaoHongShu session that can act as your account. Avoid using important accounts, do not paste real web_session cookies into code, chats, or logs, and review or remove the read-count metrics workflow, comment mutation APIs, cookie-bearing fingerprint fields, session-cookie logging, and eval-based config parser before operational use.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

eval() call detected

High

Category: Dangerous Code Execution
Content: """ 获取配置项的通用方法 """ return eval(self.config.get(section, key, fallback=fallback)) # 单例模式 xhs_config = Config()
Confidence: 99% confidence
Finding: return eval(self.config.get(section, key, fallback=fallback))

Lp3

Medium

Category: MCP Least Privilege
Confidence: 96% confidence
Finding: The skill clearly performs live network operations against XiaoHongShu but does not declare network permissions. This weakens user visibility and policy enforcement, making it easier for a user or agent to invoke external requests without informed consent or appropriate sandboxing.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documented purpose understates the skill's full capabilities while static analysis indicates broader functions including comment creation/deletion, login flows, anti-bot bypass handling, and simulated engagement/reporting behavior. This mismatch is dangerous because users may authorize a seemingly read-focused scraping tool that can actually perform account actions, manipulate engagement, or process sensitive authentication flows.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: This code does more than retrieve or present XiaoHongShu data: it sends fabricated note entry/exit telemetry and uses randomized dwell time to mimic real user reading behavior, explicitly to increase read counts. In the context of a data collection toolkit, this is deceptive engagement manipulation that can violate platform rules, misrepresent user behavior, and be abused at scale for fraud or evasion.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The add_note_readnum function is specifically designed to inflate engagement by fetching account identity, retrieving note metadata, generating a request UUID, reporting entry, optionally sleeping for a randomized interval, and then reporting exit. That behavior is not necessary for normal scraping or legitimate interaction and strongly indicates intentional artificial engagement generation.

Description-Behavior Mismatch

Medium

Confidence: 99% confidence
Finding: The function builds a randomized fingerprint but then discards it and returns a hard-coded anti-detection browser profile instead. That profile includes concrete anti-bot values and session-associated fields, showing explicit intent to spoof a trusted browser environment rather than merely compute a request signature. In this skill context, which advertises automatic handling of anti-detection parameters for scraping and interaction, this is more dangerous because it directly supports evasion of platform defenses.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: This code explicitly spoofs browser-environment attributes used by anti-automation systems, including webdriver status, plugins, GPU/renderer data, storage capability, touch support, and other fingerprinting signals. That goes beyond ordinary API signing or compatibility logic and is designed to imitate a real browser to bypass detection. Given the skill's purpose of scraping, liking, following, and collecting XiaoHongShu data, this capability materially increases risk of unauthorized automation and access-abuse.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill instructs users to supply a web_session cookie for authenticated scraping and actions but does not clearly warn that this is a sensitive session credential that can grant account access. In the context of a tool that supports follow/like and other live operations, exposing or mishandling this token could enable account takeover or unauthorized actions.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The examples present follow and like operations as ordinary API calls without an explicit warning that they cause immediate real-world actions on the user's account. In an agent setting, this increases the risk of accidental social actions, policy violations, or reputation harm because a user may assume the examples are passive data retrieval.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The authenticated-mode example shows direct insertion of a session cookie into code without clear handling guidance for secrets. This encourages unsafe credential practices such as hardcoding, copying into prompts, accidental logging, and reuse in insecure environments, all of which are especially risky for a skill capable of acting on the account.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: These network operations transmit viewer_id, author_id, request identifiers, and behavioral telemetry to a remote service without any visible consent, warning, or disclosure boundary in this file. While telemetry submission may be expected in some clients, here it is packaged as backend-like automation and combined with synthetic engagement behavior, increasing privacy and abuse risk.

Missing User Warnings

Medium

Confidence: 72% confidence
Finding: The like_note method performs a remote state-changing action against a user account with no confirmation or guardrails in this code path. In an automation skill, silent invocation of account actions can lead to unintended interactions, account abuse, or reputational harm if triggered by higher-level workflows without clear user intent.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The function serializes all cookies into a single fingerprint field, which can expose session tokens and tracking identifiers to downstream code, logs, storage, or network transmission. Because cookies may include authentication material, indiscriminately embedding them expands the blast radius of any leak or misuse. In a scraping toolkit that already handles session cookies, this is especially risky because those values are security-sensitive.

Missing User Warnings

High

Confidence: 100% confidence
Finding: The returned hard-coded fingerprint contains concrete cookie values such as a1 and webId plus concrete URLs and other session-linked data. This embeds sensitive information directly in source code, creating immediate credential leakage risk and enabling reuse of a real or test session profile by anyone with code access. In this context, the inclusion of live-looking anti-bot and session data strongly suggests unsafe operational use rather than an inert example.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The update routine reinserts the full cookie jar into the fingerprint on each refresh, perpetuating exposure of session material across repeated requests and any associated logging or persistence. This increases the chance that authentication cookies are propagated beyond their intended scope. In an automation-oriented skill, repeated inclusion of full cookies amplifies accidental leakage and misuse risk.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/request/web/encrypt/config.py:16