T09 · Insecure Skill Coding Practices
Error
- Location
xiaohongshu-publish/publish_long_text.py:93- Finding
Publishing Proceeds Without the Documented Mandatory User Approval
- Content
View full analysis
- Remediation
View remediation
Security audit
Xiaohongshu Automation Suite
Security checks for vulnerabilities and agentic risk
Overview
This skill can use a saved Xiaohongshu login to publish posts and send replies automatically, with weak safeguards and anti-detection browser behavior.
Install only if you are comfortable giving the skill persistent access to your Xiaohongshu session and allowing automation that can post or reply from your account. Use a dedicated low-risk account, protect or rotate the cookie file, avoid unattended cron jobs, and require manual preview/approval before every publish or reply. Be especially cautious with the stealth mode and no-sandbox login helper.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (5)
T09 · Insecure Skill Coding Practices
Error
- Location
xiaohongshu-reply/check_comments.py:163- Finding
Mutable Positional Indexes Can Send Replies to the Wrong Comment
- Content
View full analysis
= len(reply_buttons): print("按钮数量变化，跳过") continue reply_buttons[i].scroll_into_view_if_needed() sleep(1) reply_buttons[i].click() sleep(2) # 输入回复 textarea = page.locator('textarea').first textarea.fill(replies[i]) sleep(1) # 点击发送 send_btn = page.get_by_text('发送', exact=True).first send_btn.click() sleep(3) pr ...[truncated 1994 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
login_helper.py:67- Finding
Authentication Cookies Are Persisted Without Explicit Restrictive Permissions
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
stealth.min.js:7- Finding
Opaque Eval-Based Stealth Bundle Is Injected Into Authenticated Browser Sessions
- Content
View full analysis
{ const utils=Object.fromEntries( Object.entries(_utilsFns).map(([key,value])=>[key,eval(value)]) ); utils.init(), eval(_mainFunction)(utils,..._args) }) ``` Representative loader from `xiaohongshu-publish/publish_long_text.py`: ```python browser = playwright.chromium.launch(headless=headless) context = browser.new_context() context.add_init_script(path=STEALTH_JS_PATH) context.add_cookies(cookies) ``` ### Technical Analysis The bundled stealth script reconstructs and executes JavaScript functions from strings using `eval`. This appears consistent with the documented `puppeteer-extra` stealth-evasion generation method, and the audit did not confirm any external payload download, executable download, or unrelated network endpoint inside the bundle. Nevertheless, the code is minified, dynamically evaluated, and loaded into browser contexts that later receive authenticated account cookies. There is no checksum, signature, source pin, or integrity verification before injection. The primary risk is therefore not confirmed malware in the reviewed copy. It is the high consequence of package tampering or unreviewed replacement: any altered JavaScript would automatically run in every new page before site scripts execute. ### Attack Path 1. An attacker compromises the distribution archive, installation directory, or update process. 2. The attacker replaces `stealth.min.js` with a modified bundle while retaining the expected filename. 3. The Python scripts call `add_init_script` without verifying its i ...[truncated 976 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
login_helper.py:13- Finding
Chromium Sandbox Is Disabled During Authenticated Login
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (30)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
Using local authentication cookies from a secrets path without disclosing that access in the skill description is a real security concern. Hidden reliance on existing session material can cause silent authenticated actions under the user's account and weakens informed consent and security review.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Using local authentication cookies from a secrets path without disclosing that access in the skill description is a real security concern. Hidden reliance on existing session material can cause silent authenticated actions under the user's account and weakens informed consent and security review.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
Using local authentication cookies from a secrets path without disclosing that access in the skill description is a real security concern. Hidden reliance on existing session material can cause silent authenticated actions under the user's account and weakens informed consent and security review.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
Using local authentication cookies from a secrets path without disclosing that access in the skill description is a real security concern. Hidden reliance on existing session material can cause silent authenticated actions under the user's account and weakens informed consent and security review.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
Using local authentication cookies from a secrets path without disclosing that access in the skill description is a real security concern. Hidden reliance on existing session material can cause silent authenticated actions under the user's account and weakens informed consent and security review.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The documentation promotes automatic publishing and comment replies, and even suggests cron-based unattended automation, without consistently emphasizing account, moderation, impersonation, and content-risk consequences. In an AI-agent skill, weak warnings and guardrails can lead users to enable unsupervised actions that damage accounts, spam others, or publish unintended content at scale.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README explicitly documents bundled stealth and anti-detection capabilities for bypassing browser automation detection, including hiding navigator.webdriver and spoofing browser fingerprints. In the context of account automation for posting and replying on a third-party platform, this meaningfully increases abuse potential and facilitates evasion of platform safeguards, making the skill more dangerous than ordinary automation.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 85% confidence
- Finding
The skill advertises executable Python tooling that can read/write local files and access the network, but the manifest declares no explicit tool scope or permission boundaries. In an automation skill that performs login, cookie handling, publishing, and comment actions, missing scope declarations reduces reviewability and increases the chance of unintended or over-privileged execution.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill encourages automated publishing and comment replies without clearly warning users that it will perform live actions on their behalf using their authenticated account. In this context, silent or poorly signposted automation increases the risk of accidental spam, policy violations, reputational harm, or unintended interactions with third parties.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill openly promotes cookie capture and persistence but does not warn that cookies are sensitive authentication tokens that may grant full account access if stolen or mishandled. In the context of a social-media automation skill, persistent cookies can enable unauthorized posting, replying, or account takeover-like abuse without reauthentication.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The document explicitly instructs users to load a stealth script whose purpose is to bypass anti-bot and fingerprinting checks by modifying browser-exposed properties such as navigator.webdriver, window.chrome, plugins, permissions, and WebGL metadata. In the context of an automation suite for Xiaohongshu with 'stealth login helpers', this meaningfully enables evasion of platform detection and undermines site integrity, while the documentation provides only generic legal caveats rather than clear security, abuse, and consent warnings.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script captures authenticated Xiaohongshu session cookies from a persistent browser context and writes them to a local JSON secrets file without any explicit user consent prompt, warning, or protective controls. Session cookies are bearer credentials; anyone who can read that file may be able to hijack the account session, and the skill context makes this more dangerous because it is explicitly designed for stealth login automation and credential persistence.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This file deliberately modifies many browser fingerprinting and automation-detection surfaces, including navigator.webdriver, plugins, languages, WebGL, permissions, chrome.runtime, media capabilities, window dimensions, and iframe behavior. In the context of a social-platform automation skill with 'stealth login helpers', that goes beyond simple compatibility work and is specifically designed to evade bot detection and conceal automation, which increases abuse potential and can violate platform security controls.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The script performs stealth spoofing and sanitizes proxy-related error stacks to hide evidence of instrumentation, while providing no in-code warning, consent, or disclosure. In this skill's context, the lack of transparency makes the evasion harder to audit and easier to repurpose for deceptive automation against Xiaohongshu or similar platforms.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The code sets
navigator.languagesto['en-US', 'en']wheneveropts.languagesis empty, which imposes a specific language/locale without user opt-in. This is a natural-language policy concern because it overrides locale signaling rather than preserving user choice or documenting a justified regional constraint.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The file presents all user-facing instructions and operational guidance exclusively in Chinese, and does not indicate that the user can choose another language or opt in to this locale. Under the policy, forcing a specific language without user choice is a natural-language policy violation unless clearly justified as region-specific.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script silently loads live authentication cookies from a fixed secrets path and uses them to authenticate browser automation. In an automation skill focused on stealth login and publishing, this creates meaningful risk of unintended account use or abuse because anyone invoking the script can act as the account owner without an explicit confirmation step or credential-use warning.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script performs a real network-backed publish operation using stored authenticated cookies, but the CLI flow does not clearly warn the user that content will be submitted live to Xiaohongshu. In the context of a social-media automation suite with stealth helpers, this increases the chance of accidental or deceptive posting from a real account.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly instructs the agent to load authentication cookies from a local secrets file (
~/.openclaw/secrets/xiaohongshu.json) and use them to access a live Xiaohongshu account. Even though this is functionally necessary for automation, it involves handling sensitive credentials without an explicit warning, consent step, scope restriction, or guidance on secure storage/rotation, which increases the risk of unauthorized account access or accidental credential exposure.- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The manifest describes Xiaohongshu automation including comment management and stealth login helpers, but this file's documented purpose is viewing and replying to comments. Instead of using an explicit login flow, it accesses a local secrets file containing cookies, which is credential access beyond what comment viewing/replying itself requires and is not indicated in this file's stated intent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The function accesses a sensitive cookie file under ~/.openclaw/secrets and uses those credentials to authenticate browser actions on the user's behalf. The code lacks an explicit warning that stored credentials will be read and used, beyond a missing-file error message.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The function writes raw extracted comment content to a local plaintext file without notice, consent, or retention controls. This can expose private user interactions, usernames, and message content to other local users, backups, or later misuse, especially since the file is created automatically during routine comment retrieval.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This function reads authentication cookies, opens the Xiaohongshu notification page, fills reply text, and clicks the send button to post responses. While the main block asks for confirmation in one execution path, the function itself contains no built-in disclosure or confirmation and could be called programmatically without warning before performing account actions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The script reads authentication cookies from a local secrets file and immediately uses them to create an authenticated browser session, with no consent prompt, validation, or scope limitation. In an automation skill specifically designed for stealth login and comment management, this increases the risk of silent account takeover behavior, accidental misuse of a privileged session, or unauthorized actions if the script is run in the wrong context.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script automatically clicks the send button and posts replies without any final review, confirmation, or per-message authorization. Because this skill is for social-media automation, that behavior can directly cause unwanted public posts, spam-like activity, account enforcement, or reputational harm if the reply targets or content are incorrect.
- Content