ClawHub
Back to skill

Security audit

Xiaohongshu Assistant

Security checks for vulnerabilities and agentic risk

Overview

The skill advertises a Xiaohongshu writing helper, but it ships callable code for real account login, posting, comments, likes/bookmarks, and local account storage that is not clearly disclosed.

Review this skill before installing. Use it only if you are comfortable with the shipped account-automation code, or remove/disable xhs_publisher.py and xhs_accounts.py and avoid providing account names, browser sessions, or xsec_token values. If publishing support is intentionally used, ensure the external XiaohongshuSkills directory is trusted and require manual confirmation for every public action.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
xhs_publisher.py:15
Finding

Callable publishing module executes mutable external scripts outside the audited project

Content
View full analysis

Vulnerability Details

File Location: xhs_publisher.py:15-17, with execution sites at xhs_publisher.py:41-51, xhs_publisher.py:98-129, and xhs_publisher.py:204-282
Vulnerability Type: Unverified external dependency execution
Risk Level: Medium

Evidence

python
XHS_SKILLS_DIR = Path(__file__).parent.parent.parent / "XiaohongshuSkills"
PUBLISH_SCRIPT = XHS_SKILLS_DIR / "scripts" / "publish_pipeline.py"
LOGIN_SCRIPT = XHS_SKILLS_DIR / "scripts" / "cdp_publish.py"

The publishing path is executed as follows:

python
cmd = [
    "python", str(PUBLISH_SCRIPT),
    "--account", account,
    "--title", title,
    "--content", content,
]

if preview:
    cmd.append("--preview")
else:
    cmd.append("--headless")

if images:
    for img in images:
        if img.startswith("http"):
            cmd.extend(["--image-urls", img])
        else:
            cmd.extend(["--images", img])

try:
    result = subprocess.run(
        cmd,
        capture_output=True,
        text=True,
        timeout=120
    )

Other functions similarly execute LOGIN_SCRIPT to perform login, account management, feed retrieval, commenting, liking, and bookmarking.

Technical Analysis

The module resolves executable Python scripts from a sibling directory outside the audited project. The external XiaohongshuSkills checkout is not pinned to a reviewed version and is not validated with a signature, cryptographic digest, or trusted installation manifest before execution.

Consequently, the effective code executed by this project can change independently of the reviewed artifact. The local check_xhs_skills() function verifies only that the directory and publishing script exist; it does not establish their authenticity or integrity.

The use of an argument list rather than shell=True limits conventional shell metacharacter injection. It does not, however, protect against r ...[truncated 1641 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove xhs_publisher.py from releases advertised as content-generation-only. Do not rely on documentation or lack of imports as a security control.
  2. If publishing support is intentionally retained, require explicit administrative opt-in and clearly document every supported account action.
  3. Vendor the required implementation inside the reviewed package or install it as a version-pinned dependency from a controlled source.
  4. Maintain approved cryptographic hashes or signatures for executable dependency files and verify them immediately before every invocation.
  5. Resolve scripts only from a trusted, permission-restricted installation directory. Reject symlinks and paths writable by untrusted users.
  6. Execute publishing automation under a dedicated low-privilege account or sandbox with narrowly scoped filesystem and network access.
  7. Add tests that verify the safe release cannot invoke login, publishing, commenting, liking, bookmarking, or account-management functionality.
  8. Update README.md and SKILL.md so their capability and risk statements accurately match the shipped code.

T09 · Insecure Skill Coding Practices

Note
Location
xhs_publisher.py:214
Finding

Security tokens and unpublished content are exposed through subprocess command-line arguments

Content
View full analysis

Vulnerability Details

File Location: xhs_publisher.py:107-113, xhs_publisher.py:214-223, xhs_publisher.py:243-253, and xhs_publisher.py:273-282
Vulnerability Type: Sensitive information exposure through process arguments
Risk Level: Low

Evidence

Publishing content is placed directly in the child process argument vector:

python
cmd = [
    "python", str(PUBLISH_SCRIPT),
    "--account", account,
    "--title", title,
    "--content", content,
]

Feed-retrieval tokens are handled in the same way:

python
cmd = [
    "python", str(LOGIN_SCRIPT),
    "get-feed-detail",
    "--feed-id", feed_id,
    "--xsec-token", xsec_token
]

try:
    result = subprocess.run(
        cmd,
        capture_output=True,
        text=True,
        timeout=30
    )

Comment operations expose both the token and comment content:

python
cmd = [
    "python", str(LOGIN_SCRIPT),
    "post-comment-to-feed",
    "--feed-id", feed_id,
    "--xsec-token", xsec_token,
    "--content", content
]

Interaction operations also expose the token:

python
cmd = [
    "python", str(LOGIN_SCRIPT),
    f"note-{action}",
    "--feed-id", feed_id,
    "--xsec-token", xsec_token
]

Technical Analysis

Command-line arguments are not an appropriate transport for secrets. Depending on the operating system, process isolation configuration, monitoring software, and audit policy, argument vectors may be visible through process-inspection interfaces, diagnostic tooling, crash reports, endpoint telemetry, or command-execution logs.

The exposed values include xsec_token, account identifiers, feed identifiers, comments, titles, and unpublished post content. Although subprocess.run() does not invoke a shell here, avoiding a shell prevents command injection but does not provide confidentiality for the argument vector.

The timeout windows of up to 12 ...[truncated 1391 chars]

Remediation
View remediation

Remediation Suggestions

  1. Never pass xsec_token or equivalent credentials as command-line arguments.
  2. Transfer secrets through a protected standard-input protocol or an inherited file descriptor.
  3. If a temporary credential file is unavoidable:
    • Create it atomically with owner-only permissions.
    • Store it outside shared temporary directories where possible.
    • Reject symbolic links.
    • Delete it reliably after use.
    • Avoid including the secret in the filename.
  4. Pass titles, post bodies, and comments through standard input or a permission-restricted structured input file rather than the argument vector.
  5. Modify the external scripts to accept structured input, such as JSON over standard input, with secrets excluded from diagnostic output.
  6. Redact tokens and sensitive content from exceptions, subprocess errors, audit events, and application logs.
  7. Minimize token privileges and lifetime, and rotate any token suspected of appearing in process telemetry.
  8. Add automated tests that inspect generated command arrays and fail if secret-bearing options such as --xsec-token are present.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (30)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The manifest claims a posting-time recommendation feature, but analysis reports that functionality is missing while undeclared local note creation, saving, and list management exist instead. This mismatch is dangerous because it undermines reviewer and user trust, and hidden local persistence can retain sensitive draft content or operational data unexpectedly.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The manifest claims a posting-time recommendation feature, but analysis reports that functionality is missing while undeclared local note creation, saving, and list management exist instead. This mismatch is dangerous because it undermines reviewer and user trust, and hidden local persistence can retain sensitive draft content or operational data unexpectedly.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The manifest claims a posting-time recommendation feature, but analysis reports that functionality is missing while undeclared local note creation, saving, and list management exist instead. This mismatch is dangerous because it undermines reviewer and user trust, and hidden local persistence can retain sensitive draft content or operational data unexpectedly.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The file implements live account login and direct Xiaohongshu publishing/interaction despite the skill being described as a content assistant for drafting, title optimization, tag recommendation, and scheduling advice. This capability mismatch is dangerous because users or upstream agents may trust the skill as low-risk content tooling while it can actually perform authenticated actions on real accounts.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The code includes account enumeration/addition plus engagement actions such as commenting, liking, and bookmarking that exceed the justified purpose of a content-operations assistant. These features enable covert account manipulation and social engagement automation, increasing abuse potential for spam, reputation manipulation, or unauthorized multi-account operations.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
85% confidence
Finding

The skill manifest declares no explicit tool scope while the package is reported to have file read, file write, and shell capabilities. That creates an authority gap: a user or reviewer would expect a harmless content-assistance skill, but the implementation may execute local actions with materially broader access than advertised.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This markdown file contains user-facing instructions, examples, and templates exclusively in Chinese, which effectively forces a specific language for use of the skill. The policy allows locale constraints only when the skill offers user choice or clearly documents a justified regional limitation, neither of which appears here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This Python file explicitly defines the skill as a Chinese copywriting template library and all named styles/platforms are oriented around Chinese-language output. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly justified or optional.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This file contains user-facing skill content written exclusively in Chinese and does not state that the language is optional, user-selected, or region-specific. Under the policy rule for natural-language violations, forcing a specific language without user opt-in can be a locale policy issue.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill manifest describes advisory/content-generation features, but this module introduces persistent account tracking and local account-state management. That scope expansion is dangerous because it silently increases the data-handling surface area, creating privacy and governance risks if users do not expect the skill to store account identifiers and activity metadata.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This code writes persistent account records to a local JSON file even though the skill description only promises writing assistance, title optimization, hashtags, and posting-time suggestions. Hidden local persistence can expose account names, notes, and usage timestamps to other local users/processes and violates least surprise for a content-assistance skill.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · xhs_publisher.py (reported line 51)May include surrounding context.

python
]
    
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=30)
        if result.returncode == 0:
            return {"logged_in": True, "account": account}
        else:

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · xhs_publisher.py (reported line 161)May include surrounding context.

python
]
    
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=30)
        if result.returncode == 0:
            return {"logged_in": True, "account": account}
        else:

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · xhs_publisher.py (reported line 195)May include surrounding context.

python
]
    
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=30)
        if result.returncode == 0:
            return {"logged_in": True, "account": account}
        else:

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · xhs_publisher.py (reported line 223)May include surrounding context.

python
]
    
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=30)
        if result.returncode == 0:
            return {"logged_in": True, "account": account}
        else:

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · xhs_publisher.py (reported line 253)May include surrounding context.

python
]
    
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=30)
        if result.returncode == 0:
            return {"logged_in": True, "account": account}
        else:

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · xhs_publisher.py (reported line 77)May include surrounding context.

python
]
    
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=60)
        if result.returncode == 0:
            return {"success": True, "message": "登录成功"}
        else:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The publish function can perform a real post whenever preview is false, yet there is no explicit confirmation, warning, or second-step approval before publishing to a live account. In an agent context this creates a high risk of accidental or manipulated real-world actions, especially when content and images may come from upstream prompts or external systems.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · xhs_publisher.py (reported line 129)May include surrounding context.

python
cmd.extend(["--images", img])
    
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=120)
        
        if result.returncode == 0:
            return {

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The comment-posting operation performs a live interaction on behalf of an account without any user-facing disclosure or confirmation step. This can be abused by prompts or higher-level workflows to generate unintended public comments, causing reputational harm and policy violations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The like/bookmark helper executes real account interactions with no disclosure or confirmation, which is unsafe for an agent-accessible skill. Silent engagement automation can be used for reputation manipulation, stealthy account activity, or simply accidental interactions on the wrong content.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
89% confidence
Finding

This call dynamically constructs the subcommand using f"note-{action}" from a caller-controlled value with no allowlist validation. Although shell injection is avoided, an attacker may still trigger unintended downstream operations if the target script recognizes additional subcommands or if future changes expand accepted verbs, making this a command-selection/invocation control flaw.

Content

Scanner excerpt · xhs_publisher.py (reported line 282)May include surrounding context.

python
]
    
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=30)
        if result.returncode == 0:
            return {"success": True, "message": f"{action} 成功"}
        else:

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The module description and supported styles are presented entirely in Chinese-oriented terms, and later user-facing outputs are also hard-coded in Chinese. The file does not offer any language/locale opt-in or alternative, which matches the policy concern about forcing a specific language without user choice.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The manifest explicitly includes '发布时间建议', but the main handler only supports title generation, content generation, hashtag recommendation, draft creation, and note listing. There is no branch or helper that computes or returns recommended posting times, so the described behavior does not match the implemented functionality.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The default help text and usage examples are returned only in Chinese, with no mechanism for the user to choose another language. This is a natural-language policy issue because the skill enforces a single locale rather than offering user choice.

Content

No source excerpt is available for this finding.