Security audit

小红书竞品监控助手

Security checks for vulnerabilities and agentic risk

Overview

This skill is a mostly coherent Xiaohongshu monitoring scraper, but it runs an authenticated browser against remote web content with weak containment and persistent session data.

Install only if you are comfortable running a third-party-site scraper with a dedicated, non-personal browser profile. Avoid using a privileged account, remove the no-sandbox flags unless you run it inside a hardened disposable container, pin dependencies before installation, and clean up saved browser session data when monitoring is no longer needed.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scraper.js:258
Finding: Chromium Sandbox Disabled While Processing Remote Web Content
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:16
Finding: Unpinned and Incompletely Declared Executable Dependencies
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Rogue AgentSelf-Modification, Session Persistence
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (24)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description promises an end-to-end monitoring workflow: scraping competitor content, sending Feishu alerts, and persisting results to a data dashboard. However, the supplied code chunk does none of those things. It is only a static config/example module for storing account identifiers and URLs and exposing accessor helpers. While this may support a larger monitoring system, the actual behavior of this chunk is materially narrower than the declared purpose, so the description does not accurately represent what this code actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: 声明描述的是一个完整的竞品监控自动化流程，包括采集、通知和数据写入。但提供的代码片段只实现了一个守护进程/浏览器初始化器：启动 Chromium、打开小红书、保持会话、提示用户手动操作，并在断开后重启。代码没有展示任何笔记抓取、竞品监控逻辑、飞书集成、数据看板写入或定时触发机制。因此其实际行为与声明的核心能力明显不一致，属于描述与行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: 代码的核心确实与“小红书竞品采集”相关，但其实际能力仅限于使用 Puppeteer 打开小红书、等待用户人工登录、搜索账号并抓取少量笔记链接后写入本地 JSON 文件。声明中强调的“推送飞书通知”和“写入数据看板”在该代码片段中完全没有体现，也没有监控/定时触发机制。因此描述未准确代表该代码块的实际行为，属于功能性高估与流程差异，构成不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: 声明描述的是一个端到端的竞品监控流程，核心能力应包括数据采集、通知发送和数据落库/看板写入。但提供的代码块只是一个解析模块（parser.js），通过关键词和正则对笔记文本进行分类和字段提取，属于监控系统中的辅助子功能，而不是声明中的主要完整功能。代码没有网络请求、爬取/采集逻辑、飞书接口调用、数据库或看板写入操作，因此该代码行为与声明用途存在明显不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 从提供的代码看，scheduler.js 的主要作用是定义定时执行时间、启动 main.js 子进程，以及支持手动触发。这与声明中的业务目标“小红书竞品监控”只存在间接关系，因为真正的监控、采集、通知、写板行为并未出现在该片段中。更明显的是，注释声称执行时间是 14:06/18:06/21:06，但实际 Cron 配置为整点 14:00/18:00/21:00，存在描述与实现不一致。此外，代码展示了调度器/执行器这一能力，而声明未提及具体的定时触发机制。基于当前片段，应判定描述与实际代码行为存在不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 该代码与描述部分一致地实现了“小红书竞品笔记采集”的核心能力，但声明描述了一个更完整的监控流水线：采集、飞书通知、写入看板。实际代码只覆盖采集环节，没有任何飞书 API、Webhook、消息推送、数据库/BI/看板写入相关实现，因此描述高估了已实现功能，构成描述与行为不一致。代码中的 stealth 插件、随机延迟、滚动、搜索和抓取等属于支持采集的实现细节，不单独构成额外高风险能力偏差。
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill documentation clearly instructs use of shell commands, environment variables, browser debugging, cron, and Node execution, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization/transparency gap where an agent or user may permit broader execution than expected, increasing the chance of unintended command execution or filesystem/process access.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill description does not prominently warn that it automates third-party data collection, persists history locally, and may send data to Feishu. In this context, silent collection and outbound notification materially increase privacy, compliance, and data-handling risk because users may enable it without understanding where scraped content is stored or transmitted.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: Using npx clawhub@latest install xhs-monitor relies on a moving, unpinned package version at install time. If the upstream package is compromised or changed unexpectedly, users could execute attacker-controlled code during installation.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 86% confidence
Finding: The skill instructs users to keep a logged-in browser session running and to execute periodic cron jobs that reuse that session. Persistent authenticated sessions combined with scheduled automation increase the risk of account misuse, unintended scraping, and data access if the local machine or browser profile is compromised.
Content: Scanner excerpt · SKILL.md (reported line 159)May include surrounding context.
编辑 crontab：

bash
crontab -e # 添加以下行： 6 14 * * * /usr/bin/node /path/to/xhs-monitor/src/main.js

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This JavaScript file contains user-facing natural-language instructions entirely in Chinese, including setup steps and an important warning. Under the language/locale policy, forcing a specific language without user opt-in or justification can be a policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Comments and runtime instructions presented to the user are written entirely in Chinese, including the operational steps at runtime. This imposes a language choice without user opt-in and no justification for a Chinese-only locale is documented in the file.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The browser is launched with a persistent userDataDir, which stores cookies, login state, and other session artifacts on disk. In a skill that asks the user to log into Xiaohongshu manually, this creates a real privacy and session-handling risk if the storage location is not clearly disclosed, protected, or cleaned up, because another local user or process could potentially reuse the authenticated session.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file header presents the skill as a manual-login scraper, but the implementation also sets a persistent userDataDir, which stores authenticated browser state on disk for later reuse. This creates a security and transparency problem because a user may believe login is only temporary, while session cookies and other local browser artifacts remain available to anyone with access to the host.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The Puppeteer launch configuration uses a fixed userDataDir, which causes cookies, tokens, and other authenticated session material to be written to disk without any user-facing warning or consent flow. If the machine is shared, compromised, or the data directory is exposed, an attacker could reuse the stored session to access the logged-in account.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The scraper creates a persistent Chrome profile directory under ../data/user-data-, which can retain cookies, session tokens, browsing history, and other local artifacts across runs. In a scraping skill that targets a third-party site and may trigger login flows, silently persisting this profile increases the risk of credential leakage, unauthorized session reuse, and accumulation of sensitive local data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The script opens https://www.xiaohongshu.com/, submits the provided account name through site search, and extracts note content. While this behavior is visible from the implementation, there is no explicit warning in comments, docstrings, or user-facing output that the input will be sent to a third-party service and that external content will be collected.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The script opens an external website via page.goto(PAGE_URL), which initiates network activity to a third-party service. While there is a log saying the site is being opened, it does not function as a meaningful user warning about external connectivity or potential account/privacy implications.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The natural-language comments and labels in this file are exclusively in Chinese, with no indication that language choice is configurable or intentionally limited to a region-specific context. This can violate a language/locale policy when a skill imposes a language without user opt-in or documented justification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This code persists note metadata and part of note text to a local CSV file, which affects user data on disk. Although the file has internal comments, there is no user-facing warning, confirmation, or disclosure indicating that note information will be stored locally.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: User-visible prompts and status messages throughout the file are written only in Chinese, which effectively forces a specific language/locale. There is no indication that the user can opt into another language or that the restriction is required for a region-specific compliance reason.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The file's natural-language content is entirely in Chinese, including the startup error shown to users at L17, with no indication that language selection is configurable or that the skill is intentionally limited to a Chinese-only audience. This can violate language/locale policy when users are not given an opt-in or alternative locale.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file header comments and usage instructions are entirely in Chinese, and the generated notification content also uses fixed Chinese strings. This indicates a language-specific skill behavior without any opt-in, language selection, or justification that it is intended only for a Chinese-language environment.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The file-level natural-language comments are entirely in Chinese, which imposes a specific language context without any indication of user choice or locale scoping. Under the policy rules, language constraints should be optional or clearly justified rather than implicitly forced.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scheduler.js:24