Xiaohongshu Automation Suite

• Analyzed: May 12, 2026, 4:30 AM
• Findings: 1
• Version: 1.0.0
• Hash: 049ba16bc0dc5909a85450b064f1c1b83b52538b4666855af9102d21da5a9567
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is classified as suspicious due to a critical vulnerability in `xiaohongshu-reply/check_comments.py` and `xiaohongshu-reply/reply_fixed.py`. These scripts attempt to reply to comments by directly indexing '回复' (reply) buttons, a method explicitly warned against as unreliable and prone to 'index shifting' in `xiaohongshu-reply/SKILL.md`. This flaw could lead to the AI agent replying to unintended comments, potentially causing miscommunication or unintended information disclosure. Additionally, `login_helper.py` contains a hardcoded path for `stealth.min.js` (`/Users/lincolnwang/...`), which is a bug affecting portability, and uses `--no-sandbox` for Playwright, a general security risk in uncontained environments.