Xiaohongshu Ops Skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:31 AM UTC
• Version: 1.0.0

Overview

This skill is mostly coherent for Xiaohongshu account operations, but its installer and default storage behavior create review-worthy risks around remote code execution, persistent services, exposed tokens, and local operational records.

Review the installer carefully before running it. Avoid the one-click script unless you trust the remote installers and global packages, rotate any gateway token that was printed or shared, confirm the gateway is bound locally and removable, and add real gitignore rules before using the knowledge base. Use a dedicated Xiaohongshu account/profile where possible and require explicit confirmation before any post or reply.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

• Location: Openclaw一键安装.md:29

Finding

Remote installation script is executed directly through Bash

Content

View full analysis

Vulnerability Details

File Location: Openclaw一键安装.md:29-39
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Technical Analysis

The recommended installation script downloads an externally hosted shell script and passes it directly to Bash:

bash

ensure_nvm_loaded() {
  if [[ -s "$NVM_DIR/nvm.sh" ]]; then
    # shellcheck disable=SC1090
    . "$NVM_DIR/nvm.sh"
    return
  fi

  echo "[1/6] Install nvm..."
  curl -fsSL https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.0/install.sh | bash
  # shellcheck disable=SC1090
  . "$NVM_DIR/nvm.sh"
}

The fetched payload is not inspected or verified using a checksum or digital signature. Although the URL points to the official nvm-sh GitHub organization, the effective code is outside the audited package and is executed immediately. Compromise of the upstream repository, release reference, hosting infrastructure, or transport trust chain could therefore turn this instruction into arbitrary code execution.

This remote installer is supporting environment setup rather than functionality intrinsic to Xiaohongshu content operations. Automatically executing it exceeds the minimum behavior needed merely to load the Skill.

Attack Path

1. An attacker compromises the upstream repository, referenced release, hosting account, or content-delivery path.
2. The remote install.sh content is replaced or modified to contain malicious commands.
3. A user follows the document's recommendation and pastes the one-click installation script into a terminal.
4. curl retrieves the modified payload.
5. Bash immediately executes it with all permissions available to the invoking user.
6. The payload can access user files, alter shell configuration, install persistence, or retrieve additional malware.

Impact Assessment

Successful exploitation provides arbitrary command execution under the invoking user's account. This can ...[truncated 323 chars]

Remediation

View remediation

Remediation Suggestions

• Do not pipe downloaded content directly into a shell.
• Pin the installer to a reviewed immutable commit rather than a mutable release reference.
• Download the file separately and verify a publisher-provided cryptographic signature or SHA-256 digest before execution.
• Display the source, expected digest, and intended filesystem changes to the user.
• Require explicit approval after verification and before execution.
• Prefer documented manual installation steps or a trusted package manager with integrity verification.
• Run installation with ordinary user privileges and document a removal procedure.

T08 · Insecure Dependencies

Error

• Location: Openclaw一键安装.md:42

Finding

Unpinned global packages and optional Skills create supply-chain exposure

Content

View full analysis

Vulnerability Details

File Location: Openclaw一键安装.md:42-64; references/xhs-publish-flows.md:43-50
Vulnerability Type: Insecure third-party dependency installation
Risk Level: High

Technical Analysis

The installation instructions resolve current remote package versions instead of reviewed, immutable versions:

bash

ensure_node_npm() {
  if command -v node >/dev/null 2>&1 && command -v npm >/dev/null 2>&1; then
    return
  fi

  echo "[2/6] Install Node LTS and npm..."
  ensure_nvm_loaded
  nvm install --lts
  nvm alias default lts/* >/dev/null || true
}

use_node_lts() {
  ensure_nvm_loaded
  nvm use --lts >/dev/null || nvm install --lts >/dev/null
}

install_openclaw() {
  if command -v openclaw >/dev/null 2>&1; then
    return
  fi
  echo "[3/6] Install openclaw..."
  npm i -g openclaw
}

The publishing workflow also recommends an unpinned optional Skill:

text

This applies when Nano Banana or another external tool generates an image before the image-post workflow.

Prerequisite notice: if the image-generation Skill is not installed, run:
clawhub install nano-banana-pro

nvm install --lts, npm i -g openclaw, and clawhub install nano-banana-pro can resolve different artifacts over time. No version, digest, signature, reviewed publisher identity, or dependency lock is supplied. Global npm package installation may also run package lifecycle scripts with the invoking user's permissions.

The empty package-lock.json does not constrain these externally installed components.

Attack Path

1. An attacker compromises a package publisher, registry account, transitive dependency, or Skill distribution entry.
2. A malicious release becomes the version selected by --lts, npm's default version resolution, or ClawHub's default resolution.
3. A user follows the installation or publishing instructions.
4. The package ...[truncated 673 chars]

Remediation

View remediation

Remediation Suggestions

• Pin exact reviewed versions of Node.js, OpenClaw, and optional Skills.
• Publish and verify cryptographic hashes or signatures for every installed artifact.
• Document expected package publishers and trusted registries.
• Avoid global npm installation where a scoped, isolated installation is sufficient.
• Review lifecycle scripts and use --ignore-scripts where compatible.
• Require explicit user consent before installing optional third-party Skills.
• Maintain a dependency manifest recording version, origin, integrity value, and review date.
• Re-audit packages before updating pinned versions.

T06 · System Persistence

Warning

• Location: Openclaw一键安装.md:89

Finding

One-click setup installs and starts a persistent gateway service

Content

View full analysis

Vulnerability Details

File Location: Openclaw一键安装.md:89-93
Vulnerability Type: Cross-session service persistence
Risk Level: Medium

Technical Analysis

The recommended installation script registers and starts an OpenClaw gateway service:

bash

start_gateway() {
  echo "[5/6] Install and start gateway service..."
  openclaw gateway install || true
  openclaw gateway start || true
}

Installing a gateway service changes the host's persistent runtime state and may cause the component to remain active after the installation session. This is broader than the minimum privileges needed for the Skill's content-analysis and documentation functions.

Both commands suppress failures with || true. Consequently, the script can continue and present later output even if service registration or startup only partially succeeds. This makes it harder for the user to understand the resulting service state or detect an unsafe configuration.

Attack Path

1. The user executes the recommended one-click setup.
2. openclaw gateway install registers a persistent gateway service.
3. openclaw gateway start launches the service.
4. The service remains available beyond the immediate Skill setup session.
5. If OpenClaw, its dependencies, or its authentication configuration is later compromised, the persistent process provides a continuing attack surface.
6. Suppressed errors may prevent the user from recognizing a partially configured or unexpectedly exposed service.

Impact Assessment

The direct effect is persistent user-level service installation and an expanded local attack surface. The service can access resources granted to the OpenClaw process and remains relevant across sessions. The reviewed documentation reports a loopback dashboard address, so no confirmed external network exposure was established; however, persistence still increases the duration and scope of any later gateway compromise.

Remediation

View remediation

Remediation Suggestions

• Separate gateway service installation from basic Skill installation.
• Explain that the command creates a persistent service and require explicit opt-in.
• Provide a foreground or session-only mode as the default.
• Do not suppress installation or startup failures.
• Verify and report the final service state, bind address, authentication status, and process owner.
• Bind the gateway to loopback unless the user explicitly requests and secures remote access.
• Provide tested stop, disable, and uninstall commands.
• Apply least-privilege service permissions and restrict access to gateway configuration files.

T09 · Insecure Skill Coding Practices

Error

• Location: Openclaw一键安装.md:95

Finding

Gateway authentication token is printed in plaintext

Content

View full analysis

Vulnerability Details

File Location: Openclaw一键安装.md:95-105
Vulnerability Type: Plaintext sensitive-data disclosure
Risk Level: High

Technical Analysis

The verification function reads the gateway authentication token and prints it directly to terminal output:

bash

verify_and_print() {
  echo "[6/6] Verify installation..."
  local model token
  model="$(openclaw config get agents.defaults.model.primary || true)"
  token="$(openclaw config get gateway.auth.token | tr -d '\"' || true)"

  openclaw status | sed -n '1,35p'
  echo
  echo "Model: ${model:-<unknown>}"
  echo "Token: ${token:-<unknown>}"
  echo "Dashboard: http://127.0.0.1:18789/"
}

Authentication tokens are bearer credentials and should not be exposed in routine status output. Terminal scrollback, shell-session capture, screen recordings, support transcripts, CI logs, or remote-session logs may retain the full value.

The token retrieval needed for the later TUI command does not require displaying the token. It can remain in a shell variable and be passed directly to the process.

Attack Path

1. The user runs the one-click installer.
2. The script retrieves gateway.auth.token from OpenClaw configuration.
3. The complete token is printed to the terminal.
4. Terminal output is captured through scrollback, logging, screen sharing, support records, or another local observer.
5. An attacker extracts the token.
6. The attacker presents it to the gateway wherever the gateway is reachable and performs actions allowed by that token.

Impact Assessment

Token disclosure can allow authentication to the gateway within the token's assigned scope. The precise privileges are not defined in the audited files, so administrative access cannot be assumed. At minimum, it compromises the confidentiality of the gateway credential and may permit use of gateway functions from a process capable of reaching the config ...[truncated 13 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the line that prints the complete token.
• If identification is necessary, display only a short redacted suffix.
• Pass the token directly through a protected environment variable or standard input without echoing it.
• Warn users not to include credentials in screenshots or support transcripts.
• Restrict configuration-file permissions to the owning user.
• Add a documented token-rotation and revocation procedure.
• Ensure debug and status commands redact bearer credentials by default.
• Review existing terminal and automation logs and rotate any token that may already have been exposed.

T09 · Insecure Skill Coding Practices

Warning

• Location: references/xhs-knowledge-base.md:9

Finding

Generated operational records are claimed to be Git-ignored when no ignore file is present

Content

View full analysis

Vulnerability Details

File Location: references/xhs-knowledge-base.md:9-14; knowledge-base/README.md:20-24
Vulnerability Type: Unsafe storage and accidental information disclosure
Risk Level: Medium

Technical Analysis

The knowledge-base rules state that generated records are stored locally and ignored by Git:

text

Fixed knowledge-base locations:

- Overview: knowledge-base/README.md
- Detailed record directories: knowledge-base/accounts/, knowledge-base/topics/,
  knowledge-base/patterns/, knowledge-base/actions/, knowledge-base/reviews/
- Git strategy: detailed records are stored locally by default and ignored by
  .gitignore; only the directory skeleton and overview are version-controlled.

The overview repeats the assurance:

text

- At the end of a task, add at least one structured record to the corresponding directory.
- Detailed records under this directory are local-only and are not committed to Git;
  .gitignore has already been configured.

However, the audited directory inventory contains no .gitignore. The required record format may include account names, source URLs, note IDs, screenshots or evidence descriptions, task inputs, publication actions, reply actions, and result history. These files can therefore be staged and committed despite the documentation's assurance.

This is a configuration flaw rather than confirmed exfiltration: no generated sensitive records were present in the audited artifact, but the documented protection is absent.

Attack Path

1. The Skill creates account, topic, pattern, action, or review records after normal operations.
2. Those records include operational metadata, account identifiers, source URLs, or activity history.
3. The user trusts the documentation stating that .gitignore already excludes the records.
4. The user runs a broad Git staging command or uses an IDE that stages new files.
5. Because no .gitignore exi ...[truncated 538 chars]

Remediation

View remediation

Remediation Suggestions

• Add a project-root .gitignore that explicitly excludes generated files in:
  • knowledge-base/accounts/
  • knowledge-base/topics/
  • knowledge-base/patterns/
  • knowledge-base/actions/
  • knowledge-base/reviews/
• Preserve directory skeletons with reviewed placeholder files if needed.
• Add an automated test using git check-ignore to verify that sample generated records are excluded.
• Minimize stored identifiers and redact personal data, private URLs, tokens, and raw comment content.
• Define retention and deletion periods for operational records.
• Warn before writing records into a directory tracked by Git.
• Review repository history for previously committed records and purge sensitive history where necessary.
• Correct the documentation if local-only storage cannot be technically enforced.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (19)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 91% confidence

Finding

The curl ... | bash construct creates a direct arbitrary-code-execution chain from remote content to the shell. In installation documentation this is often convenience-driven rather than malicious, but it materially increases risk because any compromise of the fetched script or execution context immediately becomes code execution on the user's machine.

Content

Scanner excerpt · Openclaw一键安装.md (reported line 37)May include surrounding context.

md

fi

  echo "[1/6] 安装 nvm..."
  curl -fsSL https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.0/install.sh | bash
  # shellcheck disable=SC1090
  . "$NVM_DIR/nvm.sh"
}

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script programmatically retrieves the gateway authentication token and displays it in plaintext for copying. This is dangerous because it normalizes secret exposure and creates additional disclosure points, making credential theft easier if the terminal output is observed, logged, or later shared.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script prints the gateway authentication token directly to the terminal, exposing a live credential in plaintext. Terminal output is often retained in scrollback, screen recordings, support screenshots, shell logging tools, or shared sessions, so disclosure can enable unauthorized access to the local OpenClaw gateway/dashboard.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The instructions tell users to extract the full OpenClaw token into an environment variable and reuse it without any warning that it is a secret. This increases the chance of accidental leakage through shell history, process inspection in some environments, copied snippets, debugging output, or shared terminal sessions.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The post-install example stores the full token in a shell variable for later use, which encourages casual reuse of a sensitive secret. While common in quickstart docs, it can leak via copy/paste, recorded sessions, shell history workflows, or accidental echoing, especially for less technical users.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README mentions QR-code login for browser automation and persistent reuse of the session, but does not explain that this grants the skill ongoing authenticated access to the user's account/session. Without a clear disclosure of session handling, storage, and revocation steps, users may unknowingly expose account access or sensitive browsing/account data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README advertises automatic posting and comment-reply capabilities but does not clearly warn that the skill can perform account-affecting actions on behalf of the user. In an agentic/browser-automation context, this can lead to unintended publication, mass replies, reputation damage, or policy violations if users invoke the skill without understanding it can take live actions.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 137)May include surrounding context.

md

## Star 趋势

[![Star History Chart](https://api.star-history.com/svg?repos=Xiangyu-CAS/xiaohongshu-ops-skill&type=Date)](https://star-history.com/#Xiangyu-CAS/xiaohongshu-ops-skill&Date)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill metadata and description hard-code Chinese-language operation for Xiaohongshu workflows without indicating fallback to the user's preferred language or asking for consent. This can cause unintended language mismatches, reduce user control, and lead to externally posted content in an unintended language or tone.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill requires reading persona.md and mandates that all external copy follow a fixed Xiaohongshu persona/style. This removes user control over voice and messaging, and can cause the agent to send comments, replies, or posts that misrepresent the user's identity or preferences.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs the agent to persist conclusions, evidence, risks, next steps, and action records into a knowledge base by default. In a social-media operations context, this can retain sensitive account data, behavioral history, unpublished content strategy, or user-specific operational details beyond the immediate task, increasing leakage and unauthorized reuse risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown file contains user-facing instructions exclusively in Chinese, and there is no indication that the user can choose another language or that the skill is intentionally restricted to a Chinese-speaking audience for compliance or regional reasons. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The file mandates a Xiaohongshu-specific Chinese persona and writing style, including platform-specific tone and phrasing, as the default behavior. This is a natural-language policy concern because it imposes a specific language/locale/register without offering the user a choice or documenting opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly instructs persisting third-party account analysis details, review conclusions, and reusable patterns into a knowledge base, but provides no notice, consent gate, retention limits, or data-minimization guidance. Even if the source data is publicly visible on Xiaohongshu, aggregating, profiling, and storing it creates additional privacy and compliance risk, especially for competitor analysis and repeated tracking over time.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown skill file presents all operational instructions and templates exclusively in Chinese, which can amount to a language/locale policy constraint if users or operators are not given an explicit opt-in or alternative. The policy for this audit requires flagging natural-language content that forces a specific language without user choice unless the locale limitation is clearly justified.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This workflow is explicitly designed to ingest a viral Xiaohongshu post URL, extract its title, cover, body, interaction pattern, and tags, then generate a closely matching replacement post for publication. That moves beyond generic operations guidance into systematic imitation of third-party content, creating elevated risk of copyright infringement, platform policy evasion, and deceptive content laundering at scale.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The document claims a safer default of 'style-only', but later instructions direct preservation of the same theme, interaction mechanism, and content structure, which materially undermines that safety claim. This inconsistency can mislead the agent into producing outputs that are much closer to source material than represented, increasing the chance of plagiarism, policy violations, or rights abuse.

Content

No source excerpt is available for this finding.

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 84% confidence

Finding

The script fetches and executes a remote installer from GitHub in a single step. Even though this is a common installation pattern and the URL is pinned to a versioned path, it still trusts network-delivered content at execution time, so compromise of the source, transport assumptions, or user environment could lead to arbitrary code execution.

Content

Scanner excerpt · Openclaw一键安装.md (reported line 37)May include surrounding context.

md

fi

  echo "[1/6] 安装 nvm..."
  curl -fsSL https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.0/install.sh | bash
  # shellcheck disable=SC1090
  . "$NVM_DIR/nvm.sh"
}

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README states that analysis results and actions are saved locally, but does not warn that these files may contain sensitive account information, content strategy, URLs, or interaction history. Persisting such data without disclosure or retention guidance increases the risk of local data leakage, accidental commits, or exposure to other users/processes on the system.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.