xiaohongshu-skill

• Outcome: Review
• Latest audit: Aug 23, 2026 · 5:33 PM UTC
• Version: 1.5.0

Overview

This is a real Xiaohongshu automation skill, but it includes anti-detection behavior, login-popup bypassing, and direct real-account action paths that should be reviewed carefully before installation.

Install only if you are comfortable granting the skill persistent access to a Xiaohongshu browser session and allowing an agent to operate a real account. Use a dedicated test account, review every write action before it runs, protect or clear ~/.xiaohongshu session files when done, and be aware that the stealth and login-popup bypass behavior may violate platform rules or risk account enforcement.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (20)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill invokes Python/Playwright commands, manages browser sessions, performs networked actions against Xiaohongshu, and can read/write local state, but the manifest does not declare any permissions or capabilities. This creates a transparency and policy-enforcement gap: a host may expose the skill to users or automation as if it were low-privilege, while it actually has shell, filesystem, environment, and network access sufficient to affect accounts and local data.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The SOP orchestration commands enable bulk or probabilistic interaction workflows such as explore/like/collect/comment automation, which materially increases the ability to perform repeated account actions at scale. In an agent context, exposing higher-level automation not clearly constrained in the manifest raises the risk of unintended mass engagement, platform-policy abuse, and user-account misuse.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The roadmap states that account-mutating operations require explicit confirmation, but the later compatibility note indicates existing 1.x mutation commands may continue without that safeguard. In an automation skill that can publish, comment, like, or favorite on a real user account, this inconsistency can lead integrators or users to assume protections exist when they may not, increasing the chance of unintended account actions.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: This code loads and injects stealth/anti-detection JavaScript, including optional user-provided overrides from ~/.xiaohongshu/stealth.js, specifically to disguise Playwright automation. In the context of a Xiaohongshu automation skill, this enables evasion of platform bot-detection and trust signals, increasing the likelihood of account enforcement, deceptive automation, and abusive use beyond normal browsing or posting.

Context-Inappropriate Capability

Medium

• Confidence: 99% confidence
• Finding: The embedded script actively falsifies browser properties such as navigator.webdriver, plugins, languages, WebGL renderer, permissions behavior, window dimensions, and canvas fingerprints, and strips automation traces from stack output. This is classic anti-detection behavior intended to evade platform defenses, and in this skill context it materially increases the capability for covert automation against Xiaohongshu.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The code intentionally removes Xiaohongshu's login modal and overlay via JavaScript so scraping can continue without following the site's intended access control flow. Even though it is not a memory-safety flaw, it is a policy and access-control bypass that enables unauthorized content access and makes the automation materially riskier in a scraping skill.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The docstring explicitly describes DOM removal as a way to avoid redirection and keep loading search results, which indicates awareness that the site is trying to interrupt unauthenticated access. Misrepresenting that behavior as harmless increases the likelihood that operators will overlook an intentional gate-bypass mechanism and deploy it inappropriately.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The changelog explicitly advertises an "anti-detection upgrade," which signals intent to evade platform bot-detection or enforcement mechanisms. In the context of a browser automation skill for Xiaohongshu account actions, documenting evasion features without clear warnings about account suspension, policy violations, or legal/compliance risk normalizes unsafe use and may encourage operators to bypass platform safeguards.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The publishing commands create real posts, videos, markdown-rendered images, and scheduled posts, but the documentation does not prominently warn that these are live account actions with public-facing consequences. In an agent environment, insufficient signaling around write operations can cause accidental publication, reputational harm, or scheduling of unwanted content.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The comment, reply, like, and collect commands perform real engagement actions on behalf of the logged-in user, yet the documentation does not clearly warn about those side effects. Because the skill is specifically designed for Xiaohongshu account automation, missing warnings make accidental or unauthorized social actions more dangerous than in a generic API reference.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The README explicitly states that authentication cookies are automatically persisted under ~/.xiaohongshu/ after QR-code login, but it does not warn users that these cookies may grant ongoing account access to anyone who can read that directory. In the context of a publishing/automation skill for a social platform, stolen session cookies could enable unauthorized posting, reading account data, or account takeover-like misuse without requiring the user's password again.

Missing User Warnings

Medium

• Confidence: 81% confidence
• Finding: The client persists browser profile data and separately backs up cookies to disk, which can retain authenticated session material and other sensitive browsing state. Without explicit user-facing notice, retention policy, encryption, or file-permission safeguards in this file, local compromise or multi-user environments could expose account sessions.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The code posts comments directly after local validation and navigation, with no built-in user confirmation gate despite the skill metadata stating that any write operation must first obtain user confirmation. In an automation skill that performs authenticated social actions, this creates a real risk of unintended posting if higher-level callers forget or bypass confirmation.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: If target comment lookup fails, the function logs the error and proceeds to submit the reply through the generic comment box anyway. That can cause content intended as a reply to be posted as a top-level comment or attached to the wrong target, leading to unintended public actions from the user’s authenticated account.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: When no reply button is found on the selected notification item, the code clicks the notification item itself and then proceeds to type and submit content without confirming what page or reply target was opened. In a logged-in social automation context, this can result in replies or comments being sent to an unintended post or conversation.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The logout function irreversibly deletes the browser profile directory, cookie file, and a strategy file without any confirmation, dry-run, or path safety checks in this file. In an agent skill context, exposing such a function increases the risk of unintended local data loss if the action is triggered automatically, misrouted, or called with attacker-influenced paths.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Silently stripping the login popup via JavaScript hides from the user that the tool is bypassing a site control and continuing to collect data under altered page conditions. In an agent skill that automates browsing, lack of disclosure reduces user awareness and consent around potentially noncompliant collection behavior.

Missing User Warnings

Medium

• Confidence: 76% confidence
• Finding: The wrapper loads cookies from a configured path and starts a browser session with them, which can expose an existing authenticated session without any disclosure or per-action confirmation in this function. In a skill capable of reading and posting on behalf of a user, undisclosed session reuse increases the risk of unintended account access and data collection.

Known Vulnerable Dependency: markdown — 2 advisory(ies): CVE-2025-69534 (Python-Markdown has an Uncaught Exception); CVE-2025-69534 (Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like se)

High

• Category: Supply Chain
• Confidence: 96% confidence
• Finding: The project allows markdown versions >=3.5 and <4, which includes the flagged vulnerable release line noted by the advisory. Because this skill processes user-facing content workflows and may render or transform markdown as part of publishing or long-form note handling, malformed attacker-controlled input could trigger denial of service or crashes in the agent runtime.

Known Vulnerable Dependency: Pygments — 10 advisory(ies): CVE-2026-4539 (Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Reg); CVE-2021-20270 (Infinite Loop in Pygments); CVE-2015-8557 (Command Injection in Pygments) +7 more

Critical

• Category: Supply Chain
• Confidence: 91% confidence
• Finding: The dependency constraint Pygments>=2.17,<3 permits versions affected by multiple historical advisories, so the package policy is vulnerable unless resolution is guaranteed to a patched release. In this skill, Pygments is likely used for formatting or display rather than direct code execution, which reduces the practical impact, but untrusted content could still trigger denial of service or other parser-related issues depending on usage.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.