RedBookSkills - 小红书发布助手

• Outcome: Review
• Latest audit: May 28, 2026 · 11:22 AM UTC
• Version: 1.0.0

Overview

The skill is a real Xiaohongshu automation tool, but it can act on a live account, expose login QR data, and publish by default, so it belongs in Review before installation.

Install only if you are comfortable giving the skill control of a logged-in Xiaohongshu browser session. Use --preview or fill-only workflows first, verify the target account and content before any publish or engagement command, avoid remote CDP unless you fully trust the endpoint, and treat login QR output, Chrome profiles, notification payloads, and exported analytics as sensitive account data.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (16)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

for line in result.stdout.splitlines():
                if f":{port}" in line and "LISTENING" in line:
                    pid = line.strip().split()[-1]
                    subprocess.run(
                        ["taskkill", "/F", "/PID", pid],
                        capture_output=True, timeout=5
                    )

• Confidence: 82% confidence
• Finding: The code extracts a PID from untrusted netstat output using loose string matching and immediately passes it to taskkill. While this is not shell injection, weak parsing could terminate the wrong process if output is malformed, ambiguous, or unexpectedly matched, causing local denial of service or disruption of unrelated applications.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill advertises extensive capabilities including shell execution, file read/write, network access, and environment interaction, but does not declare permissions or clearly bound those powers. This creates a trust and review gap: an operator may approve a seemingly simple publishing skill without realizing it can launch browsers, access local files, download remote content, and interact with remote Chrome instances.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence
• Finding: The documented purpose says the skill is for XHS publishing, login checks, search, interaction, and data capture, but the behavior appears to extend beyond that into arbitrary URL media downloading, account/profile management, local Chrome lifecycle control, and broader content-generation/analysis features. This mismatch is dangerous because reviewers and users may underestimate the operational and data-access scope, increasing the chance of unintended file access, process control, or privacy-impacting automation.

Description-Behavior Mismatch

Low

• Confidence: 93% confidence
• Finding: The skill captures and returns the live login QR code as base64/data URL, which can enable remote parties to complete authentication if they can view or reuse that code before expiry. Because this exposes an authentication artifact outside the browser session, it materially increases the risk of account takeover beyond ordinary login assistance.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The README states that `publish_pipeline.py` automatically publishes by default, which creates a real safety risk because a user or agent may trigger an irreversible public posting action without an explicit confirmation step. In an agent-skill context, side-effectful defaults are especially dangerous because natural-language invocation or automation can cause unintended account actions on a live platform.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill contains instructions for publishing, commenting, replying, liking, and bookmarking on a live user account, but does not prominently warn that these are state-changing actions on a real platform. In an agent setting, insufficient modification warnings increase the risk of accidental posting or engagement, especially because the skill also supports headless automation and direct execution flows.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The skill supports collecting homepage feeds, notifications, profile data, and content metrics without a visible privacy notice or data-handling warning. Even if this is functionally relevant, the lack of disclosure is risky because these features may gather account-linked or third-party content data that users and reviewers may not realize is being accessed or retained.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: Returning an active authentication QR code without a strong warning or access control exposes a credential-equivalent token to any caller, logger, or downstream system handling the response. In this skill context, remote browser automation makes that especially dangerous because the resulting authenticated session can be used immediately for publishing and account actions.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The code fetches and prints notification mentions payloads from an authenticated session, which may include private interaction data, user identifiers, and message content. Exposing this data without clear disclosure, minimization, or output controls can leak sensitive account information to unintended consumers of the skill output.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The pipeline publishes by default unless --preview is supplied, and the code proceeds directly from form fill to clicking the publish button without a last-step confirmation. In a skill whose purpose is automated posting to Xiaohongshu, this creates a real risk of unintended external actions if upstream inputs are wrong, manipulated, or triggered accidentally.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The guide instructs users to automatically publish content to Xiaohongshu and run analytics on note data without any warning that content and metadata will be transmitted to an external platform. In an automation skill, missing disclosure increases the risk of unintended posting, privacy exposure, and account misuse because users may treat the workflow as local-only or fail to validate what is being sent.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documented command publishes text and images to an external platform, but the workflow provides no warning, confirmation step, or privacy notice. This increases the risk of accidental disclosure of sensitive draft content, metadata, or private images, especially in an automation skill centered on social posting.

Missing User Warnings

Medium

• Confidence: 81% confidence
• Finding: The documentation instructs users to copy an example API key file and populate it with secrets, but provides no warning about protecting those credentials from accidental disclosure through source control, shared systems, or insecure file permissions. In an automation skill that interacts with external services, exposed API keys can enable unauthorized usage, billing abuse, or access to connected content workflows.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The example command performs an actual publish action to Xiaohongshu but does not clearly warn that running it will submit content to an external platform under the user's account. In this skill context, automation against a live social media account increases the risk of accidental posting, reputational damage, policy violations, or unintended disclosure of draft/private material.

Ssd 2

Medium

• Confidence: 97% confidence
• Finding: The instruction to use randomized, human-like interaction specifically to avoid system detection indicates deliberate anti-detection behavior. In the context of an automation skill for Xiaohongshu publishing and interaction, this increases the likelihood that the tool is intended to evade platform abuse controls, enabling stealthier spam, fake engagement, or policy-violating account operations.

Unvalidated Output Injection

High

• Category: Output Handling

Content

for line in result.stdout.splitlines():
                if f":{port}" in line and "LISTENING" in line:
                    pid = line.strip().split()[-1]
                    subprocess.run(
                        ["taskkill", "/F", "/PID", pid],
                        capture_output=True, timeout=5
                    )

• Confidence: 86% confidence
• Finding: This is the actual sink: a PID derived from prior command output is used in a privileged process-termination command without strong validation. In the context of a browser-automation skill, this increases risk because the skill manages long-lived local browser sessions and could accidentally or maliciously disrupt other local processes if parsing or matching is wrong.

VirusTotal

VirusTotal engine telemetry is currently stale for this artifact.

Static analysis

No suspicious patterns detected.