ClawHub
Back to skill

Security audit

小红书爆款文案拆解

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly a disclosed read-only XHS content-analysis helper, but it unnecessarily requires agents to preserve and redistribute tokenized XHS URLs.

Review this skill before installing if you may provide or receive XHS links containing xsec_token. Its read-only SocialDataX workflow is otherwise coherent, but tokenized URLs can be copied into chats, logs, saved files, or forwarded outputs; prefer a version that strips sensitive query parameters from visible or stored results.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill explicitly instructs agents to preserve and re-display full XHS note URLs including the `xsec_token` query parameter. Security-bearing or session-like URL tokens should be treated as sensitive because they may grant access, enable replay/sharing beyond intended scope, or leak user-linked tracking data when copied into outputs, logs, storage, or downstream tools. In this skill’s context, the risk is elevated because the instruction normalizes repeated propagation of the token rather than minimizing it.

Ssd 3

High
Confidence
99% confidence
Finding
The skill goes beyond transient use and instructs that full note URLs including `xsec_token` be preserved during answering, display, citation, storage, output, and forwarding. This is a strong data-handling flaw because it mandates broad redistribution of a potentially sensitive token, increasing exposure through chat transcripts, logs, analytics systems, and copied artifacts. Given the skill is for content analysis, retaining the token everywhere is unnecessary and makes the behavior more dangerous than the surrounding read-only context would suggest.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.