Xhs Data

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:05 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed Xiaohongshu data-scraping helper, with practical cautions around account sessions, local storage, and unpinned Python packages.

Install dependencies in an isolated virtual environment, review or pin package versions before use, and only provide Xiaohongshu login/session data if you understand the account and platform risks. Check the fixed ~/disk/xiaohongshu output paths before running because collected content and media may persist locally.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:23

Finding

Unpinned and Unverified Third-Party Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 23-25
Vulnerability Type: Unpinned dependency installation
Risk Level: Medium

Complete Code Snippet:

bash

pip install aiohttp loguru pycryptodome getuseragent

Technical Analysis

The skill directs users or agents to install four third-party Python packages without exact version constraints, package hashes, a lockfile, or an explicitly trusted package index. Consequently, package versions and transitive dependencies are resolved dynamically from the configured package repository when the command is executed.

This makes installation non-reproducible and prevents the installed artifacts from being matched reliably to versions reviewed during the skill audit. If a dependency account, package release, transitive dependency, or configured package index is compromised, malicious installation hooks or package code could execute with the privileges of the process running pip.

The project contains no accompanying implementation or dependency manifest through which the required versions and dependency provenance could be verified. This finding does not establish that any of the named packages are currently malicious; it identifies the unsafe and unverifiable installation practice.

Attack Path

1. An attacker compromises a selected dependency, one of its transitive dependencies, or a package index configured in the execution environment.
2. The attacker publishes a malicious release or causes dependency resolution to return an attacker-controlled artifact.
3. A user or agent follows the skill documentation and runs the unpinned pip install command.
4. pip resolves and downloads the attacker-controlled package version.
5. Malicious build or installation logic may execute during installation. Malicious runtime logic may also execute when the installed package is imported by the unavailable crawler implementation.
6. The payload operates with ...[truncated 738 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the inline installation command with a reviewed dependency manifest that pins every direct dependency to an exact version.
2. Generate and retain a lockfile that records resolved transitive dependencies.
3. Require cryptographic hashes for downloaded distributions, such as with a hash-locked requirements file and pip install --require-hashes.
4. Configure an explicitly trusted package index and prevent unintended fallback to untrusted or private indexes.
5. Install dependencies inside an isolated virtual environment or container using an unprivileged account.
6. Review package provenance, release history, maintainership, and transitive dependencies before approving versions.
7. Add automated dependency vulnerability and integrity scanning to the release process.
8. Include the referenced crawler implementation in the project so its imports, dependency usage, network behavior, and data handling can be audited.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

This markdown file documents that the skill stores user-homepage data and post data under fixed directories, which is a user-data-affecting behavior. Although outputs are described, there is no clear warning or caution to the user that running the skill will create files/directories and persist downloaded content locally.

Content

No source excerpt is available for this finding.