Security audit

xiaohongshu-skill

Security checks across malware telemetry and agentic risk

Overview

The skill is a disclosed Xiaohongshu automation tool, but it includes stealth browser behavior, login-popup suppression, and live account actions that need review before use.

Install only if you are comfortable giving the skill a persistent Xiaohongshu browser session and the ability to act on a real account. Use a dedicated/test account, protect ~/.xiaohongshu like a password store, require human review before every write command, and be aware that the skill contains platform-evasion behavior that may violate Xiaohongshu rules.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 96% confidence
Finding: The skill declares no permissions while explicitly instructing the agent to run Python, shell commands, Playwright browser automation, and maintain local browser/session state. This creates a capability-transparency gap: users and the hosting platform may not realize the skill can access files, environment variables, network resources, and modify local state, which increases the risk of over-privileged execution or unintended data exposure.

Description-Behavior Mismatch

Medium

Confidence: 82% confidence
Finding: The API documentation exposes strategy generation, posting-plan management, and SOP-style automation workflows that go beyond simple search/read/publish primitives and materially increase the skill’s operational scope. This is dangerous because downstream agents may invoke growth, engagement, or bulk-action features without recognizing that they enable higher-risk automation and account activity that can violate user expectations or platform rules.

Intent-Code Divergence

Medium

Confidence: 89% confidence
Finding: The roadmap documents a safety requirement for explicit confirmation before any account-mutating operation, but also states that current 1.x mutating CLI behavior remains compatible without an explicit execution flag. In a skill that can publish, comment, like, and save content on a live user account, this mismatch creates a realistic risk of unintended writes if downstream agents or wrappers invoke commands incorrectly or assume dry-run/preview semantics that do not exist.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The client injects extensive anti-detection code to hide browser automation, spoof browser fingerprints, and load arbitrary local stealth overrides before every page load. In the context of a Xiaohongshu automation skill, this meaningfully increases risk because it is designed to evade platform detection and can facilitate deceptive automated activity using a persisted logged-in session.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The logout function deletes the entire persisted browser profile directory, cookie file, and an additional strategy file under the user's home directory. In an agent skill context, this is broader state destruction than a user would typically expect from 'logout' and can erase unrelated session or automation state without explicit consent, causing denial of service or unexpected account/session loss.

Description-Behavior Mismatch

Medium

Confidence: 98% confidence
Finding: The code explicitly removes Xiaohongshu's login modal and overlay from the DOM so unauthenticated users can continue loading search results. That is a deliberate bypass of an access-control or anti-automation gate imposed by the site, increasing legal, compliance, and platform-abuse risk even if it does not exploit the host running the skill directly.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The inline comment rationalizes DOM removal as a way to preserve the URL, but the operational effect is to defeat the platform's login enforcement. Misleading documentation around a gate-bypass makes review harder and can conceal behavior from downstream users or maintainers.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The documentation presents commenting, replying, liking, collecting, and similar commands as ordinary CLI actions without prominent warnings that they perform live mutations on a real account. In an agent setting, this is dangerous because automation may execute these commands directly, causing unintended public interactions, account reputation damage, or platform-policy violations before a human realizes the actions are not read-only.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The publish, auto-publish, and scheduled publish examples omit strong warnings that they can create irreversible public posts or queued future posts on a real social-media account. In this skill context, that is especially risky because the tool is designed for agent-driven Xiaohongshu automation, so an LLM or operator could mistake examples for safe test commands and unintentionally publish content at scale or at the wrong time.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The README instructs users to authenticate via QR code and states that cookies are automatically persisted under ~/.xiaohongshu/ without warning that these cookies may function as long-lived session credentials. If that directory is exposed through backups, shared machines, weak permissions, or malware, an attacker may reuse the session to access or act through the user's Xiaohongshu account.

Missing User Warnings

Medium

Confidence: 85% confidence
Finding: The README says Claude will automatically run corresponding commands, while the skill supports state-changing actions such as posting, commenting, liking, and collecting. Even though the skill metadata says write actions require user confirmation, this README section does not warn users that automation may trigger account actions or encourage them to verify confirmation safeguards before enabling the skill.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The logout routine performs destructive local deletions with no in-function confirmation, warning, or dry-run mechanism. In an agent setting, if this action is triggered indirectly or unexpectedly, it can wipe persisted browser data and cookies, disrupting workflows and potentially removing other saved sessions that share the same profile path.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The code silently removes a login popup and related overlays with injected JavaScript, bypassing a site-imposed restriction without disclosure. This creates covert automation behavior and increases the risk of unauthorized scraping, account enforcement, or policy violations in a skill that interacts with a third-party platform.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The trigger phrases are broad enough to match ordinary user queries about Xiaohongshu rather than explicit requests to invoke automation. In an agent-skill ecosystem, that can cause unintended tool activation, leading the agent to access browser state, session-backed data, or platform actions when the user only wanted discussion or analysis.

Known Vulnerable Dependency: markdown — 2 advisory(ies): CVE-2025-69534 (Python-Markdown has an Uncaught Exception); CVE-2025-69534 (Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like se)

High

Category: Supply Chain
Confidence: 87% confidence
Finding: markdown

Known Vulnerable Dependency: Pygments — 10 advisory(ies): CVE-2026-4539 (Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Reg); CVE-2021-20270 (Infinite Loop in Pygments); CVE-2015-8557 (Command Injection in Pygments) +7 more

Critical

Category: Supply Chain
Confidence: 83% confidence
Finding: Pygments

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.