T09 · Insecure Skill Coding Practices
Error
- Location
- xiaohongshu-publish/publish_long_text.py:93
- Finding
- Publishing Proceeds Without the Documented Mandatory User Approval<![CDATA[ ## Vulnerability Details **File Location**: `xiaohongshu-publish/publish_long_text.py:93-98` **Related Requirement**: `xiaohongshu-publish/SKILL.md:42-48` **Vulnerability Type**: Missing authorization control for an irreversible external action **Risk Level**: High ### Vulnerable Code ```python print('🚀 发布...') page.locator('button:has-text("发布")').last.click() sleep(5) # 检查结果 current_url = page.url success = 'published=true' in current_url ``` The Skill documentation states that content must be reviewed by the account owner before publication, but the executable code does not implement that requirement. It clicks the publication button immediately after receiving the title and content. ### Technical Analysis Publishing content is an externally visible, account-authorized, and potentially irreversible operation. The function accepts content directly through arguments and does not provide: - An interactive confirmation immediately before publication. - A preview-only or dry-run mode. - An approval token or other out-of-band authorization. - Validation that the user has reviewed the final formatted content. - A distinction between preparing a draft and making it public. Documentation-level instructions are not a reliable security boundary. An Agent, automation workflow, or scheduled process can invoke this function directly and bypass the documented review requirement. ### Attack Path 1. An Agent workflow obtains untrusted, malformed, or attacker-influenced text. 2. The workflow passes the text through the `--title` and `--content` arguments. 3. The script loads authenticated Xiaohongshu cookies. 4. The script fills the title and content into the creator interface. 5. It clicks the final publication button without requesting user approval. 6. The content becomes publicly associated with the victim's account. ### Impact Assessment An attacker who can influence an Agent invocation or its content may cause unauthorized public posts. Potential ...[truncated 448 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Default to a preview or draft-only workflow. 2. Require explicit approval immediately before the final click, after showing the exact title and final content. 3. For non-interactive use, require a short-lived approval token tied to a hash of the exact content. 4. Separate content preparation from publication into different functions or commands. 5. Reject automated publication unless an explicit `--approved` option is supplied through a trusted control path. 6. Record the approved content hash, approval time, and resulting post URL in an audit log. 7. Add tests confirming that the publication button cannot be clicked without approval. ]]>