xhs-hot-topic-selection

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:18 AM UTC
• Version: 0.1.8

Overview

The skill is mostly a read-only Xiaohongshu trend-analysis helper, but it should be reviewed because it runs a mutable npm package and requires token-like URLs to be preserved and shared broadly.

Review before installing. Prefer a pinned, reviewed version of socialdatax-skills or an already configured MCP tool instead of npx @latest, and run it with only the SOCIALDATAX_API_KEY it needs. Treat returned note_url values containing xsec_token as potentially sensitive; avoid storing or forwarding full URLs unless the user specifically needs them.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:26
• Finding: Unpinned Remote npm Package Is Downloaded and Executed<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 26–37 **Vulnerability Type**: Remote execution of an unpinned third-party dependency **Risk Level**: High ### Vulnerable Code ```bash ## Preferred Direct CLI Prefer the direct CLI when the agent can run shell commands. It does not require MCP server configuration: ```bash npx -y socialdatax-skills@latest xhs hot-search \ --pretty --source-client socialdatax-skills --source-platform clawhub \ --source-skill xhs-hot-topic-selection npx -y socialdatax-skills@latest xhs search \ --keyword "<hot_topic_or_keyword>" --sort-type like_count_descending --pages 2 \ --max-items 20 --pretty --source-client socialdatax-skills --source-platform clawhub \ --source-skill xhs-hot-topic-selection ``` ``` The project metadata also declares the same package without an exact version: ```yaml metadata: {"openclaw":{"requires":{"env":["SOCIALDATAX_API_KEY"],"bins":["node","npm"]},"primaryEnv":"SOCIALDATAX_API_KEY","install":[{"kind":"node","package":"socialdatax-skills","bins":[]}],"emoji":"🧭","homepage":"https://socialdatax.com/ai?from=clawhub"}} ``` ### Technical Analysis The instructions use `npx -y socialdatax-skills@latest`, which downloads and immediately executes the current package release without pinning an audited version or integrity hash. The `-y` option suppresses the installation confirmation, while `@latest` allows the effective executable payload to change after this Skill has been reviewed. The downloaded implementation is not present in the audited project. There is also no lockfile, checksum, signature requirement, or vendored source through which its runtime behavior can be verified. This package executes in an environment that is expected to contain `SOCIALDATAX_API_KEY`. It may also inherit the invoking agent's filesystem access, environment variables, process permissions, and network capabilities. Consequently, compromise of the package publisher, registry account, distr ...[truncated 1481 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace `socialdatax-skills@latest` with an exact, reviewed package version. 2. Pin the package's integrity hash through a lockfile or an equivalent verified installation mechanism. 3. Remove `npx -y` from the recommended workflow so installation or version changes are not silently accepted. 4. Vendor the reviewed implementation where practical, allowing its behavior to be audited with the Skill. 5. Verify package signatures or provenance attestations before execution. 6. Run the CLI in a restricted sandbox with: - Access only to the required API key. - No access to unrelated environment variables. - Read-only or narrowly scoped filesystem permissions. - Outbound network access limited to documented service endpoints. 7. Document the exact expected API hosts and reject unexpected redirects or destinations. 8. Establish a controlled dependency-update process in which new versions are reviewed before the pinned version is changed. ]]>

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:82
• Finding: Mandatory Disclosure of Token-Bearing Xiaohongshu URLs<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 82 **Vulnerability Type**: Sensitive token exposure through output, storage, and forwarding **Risk Level**: Medium ### Vulnerable Code ```text For XHS search results, in every use of a returned `note_url`, such as final answers, display, references, storage, output, or forwarding, preserve it exactly as the full URL, including `xsec_token` query parameters. Do not modify, truncate, redact, mask, normalize, rebuild, or synthesize the URL from `note_id`. ``` ### Technical Analysis The Skill explicitly requires query parameters named `xsec_token` to be retained in every use of a returned URL. It prohibits redaction even when the URL is displayed, stored, logged, or forwarded. This instruction conflicts with secret-minimization and least-disclosure principles. Topic analysis does not inherently require token-bearing URLs to be reproduced in all downstream contexts. The analysis can generally rely on public note metadata, a note identifier, or a redacted URL unless a full service-provided URL is necessary for a specific user-requested action. Query-string tokens are especially vulnerable to incidental disclosure because URLs commonly enter: - Agent and conversation transcripts. - Application and proxy logs. - Analytics and telemetry systems. - Stored reports and generated artifacts. - Link previews and external URL-processing services. - Forwarded messages and shared documents. The file does not establish the exact authorization semantics or lifetime of `xsec_token`. Nevertheless, forcing preservation of a token-like query parameter removes the ability to apply contextual redaction and unnecessarily expands its exposure surface. ### Attack Path 1. The SocialDataX operation returns a `note_url` containing an `xsec_token` query parameter. 2. The agent follows the Skill instruction and reproduces the full URL in a response, stored artifact, reference, or forwarded output. 3. The receiving p ...[truncated 929 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the instruction that universally prohibits redaction, masking, or truncation of `xsec_token`. 2. Treat all token-like query parameters as sensitive by default. 3. Strip `xsec_token` from responses, logs, stored artifacts, analytics, and forwarded content unless it is strictly required for a user-approved operation. 4. Prefer a public canonical URL, public note identifier, or non-sensitive reference when presenting analysis results. 5. If a full token-bearing URL is necessary: - Obtain explicit user approval before disclosing it. - Display it only in the immediate context where it is needed. - Avoid storing or forwarding it. - Warn the user that the URL may contain sensitive access or tracking information. 6. Introduce structured output fields that separate public note metadata from sensitive navigation URLs. 7. Configure log and telemetry redaction to remove `xsec_token` and equivalent query parameters. 8. Document the token's purpose, authorization scope, expiration behavior, and safe handling requirements. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence
• Finding: The skill instructs the agent to execute `npx -y socialdatax-skills@latest`, which pulls and runs the newest package version at runtime without pinning or integrity verification. That creates a supply-chain risk: a compromised upstream package, malicious maintainer update, or dependency hijack could cause arbitrary code execution in the agent environment.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence
• Finding: This second command repeats the same unsafe pattern by invoking `npx -y socialdatax-skills@latest` for search operations. Because the package is fetched dynamically at execution time, any malicious or unexpected update could run arbitrary code and access environment secrets such as `SOCIALDATAX_API_KEY`.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- `--pretty`: output formatting only.
- `--source-client socialdatax-skills --source-platform clawhub --source-skill xhs-hot-topic-selection`: usage attribution for this Agent Skill; keep these values unchanged when running examples from this Skill.

Use `xhs hot-search` for the current Xiaohongshu / XHS / RedNote search hot list. Do not ask the user for `--keyword` for this command.

## Safety Boundary

• Confidence: 80% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The instructions explicitly require the output to be in Chinese ('输出为热榜选题分析') and prescribe Chinese response structure regardless of user preference. This is a natural-language locale policy issue because the file does not offer a language choice or state that Chinese is optional.

Ssd 3

Medium

• Confidence: 98% confidence
• Finding: The skill explicitly instructs the agent to preserve and forward full `note_url` values including `xsec_token` query parameters in every display, storage, and forwarding path. If those query parameters function as access tokens, tracking tokens, or signed URLs, this causes unnecessary propagation of sensitive URL components into logs, chats, downstream systems, and persistent storage, increasing leakage and replay risk.

Static analysis

No suspicious patterns detected.