Security audit

小红书发布

Security checks for vulnerabilities and agentic risk

Overview

This is a real Xiaohongshu publishing skill, but it asks users to run unverified external software and includes live-posting flows without strong safeguards.

Install only if you trust the MCP server source and can verify the executable and npm package provenance. Use a non-admin account, avoid sensitive/private images or text, confirm the target Xiaohongshu account before publishing, and do not run the bundled publish_*.js examples unless you intentionally want their hardcoded content posted publicly.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:16
Finding: Unpinned and Unverified Third-Party Dependencies
Content: View full analysis
Remediation: View remediation
`. - Prefer a project-local development dependency instead of a global installation. - Use a lockfile with integrity metadata. - Disable lifecycle scripts during installation when compatible with the package. - Document the official package owner and registry source. 3. Pin the MCP server to a specific reviewed release and provide its official HTTPS download URL. 4. Publish the expected SHA-256 checksum and require users to verify it before execution. 5. Require verification of the executable's digital signature and expected publisher identity. 6. Advise users to run the service as a non-administrative account with access limited to the image files and resources needed for publishing. 7. Document a secure upgrade process that requires review and integrity verification before changing dependency versions. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (13)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: 代码的核心功能与声明的大方向基本一致：它确实用于小红书内容发布，并支持检查登录状态。具体实现上，它通过向 localhost:18060 的 MCP 服务发送 JSON-RPC 请求，调用 check_login_status 和 publish_content 工具；同时读取本地文件系统仅用于检查图片路径是否存在，这属于发布功能的合理支持细节，不构成额外高风险未声明能力。主要不一致在于：声明明确写了“获取登录二维码”，但代码没有任何获取二维码的函数、命令行参数或工具调用；另外声明强调“批量发布、定时发布等”使用场景，而当前代码只支持单次调用发布，未见批量调度或定时机制。因此描述相较代码存在实质性过度声明，应判定为不匹配。
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill automates posting content to a third-party platform and necessarily transmits user-supplied text and image data over the network, but the description does not clearly warn users about that external data transfer. This can lead to accidental disclosure of sensitive content or unintended publication from the user's account because users may treat the skill as local-only automation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The example publish commands are presented as routine usage without a clear warning that they will create real posts on the user's Xiaohongshu account. In an automation context, this increases the chance of unintended live actions, reputational harm, and accidental posting of test or sensitive content, especially because the skill is designed for batch and repeated use.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The visible content is entirely in Chinese, including the main heading, subtitle, and call to action. Under the policy, forcing a specific language without user opt-in or a documented region-specific justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The post title, body text, examples, and success messages are all hard-coded in Chinese, which imposes a specific language/locale on the generated publication flow. There is no visible user opt-in, language selection, or documentation that this skill is intentionally limited to a Chinese-language audience.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This script performs a real publish action immediately by calling publish(config) when the file is run, and there is no confirmation prompt, dry-run mode, or visible user acknowledgement in this file. In the context of a skill designed for automated Xiaohongshu posting, that means content can be posted accidentally, unexpectedly, or as part of a larger automated workflow without an explicit final consent step.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The post title, body, and tags are hard-coded entirely in Chinese, which indicates the skill produces output in a specific language with no visible user opt-in or language-selection mechanism. This matches the policy category for language or locale constraints that are imposed without user choice.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The document gives direct instructions for publishing content and checking login state via local cookies, but it does not clearly warn that these actions can affect a real user account and may post content publicly. In an automation skill for a social platform, missing safety and consent warnings increases the chance of accidental or unauthorized posting, especially in batch or scheduled workflows.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill’s description and all user-facing CLI messages are hardcoded in Chinese, indicating a fixed language choice for operation. This is a natural-language policy concern because the script does not offer any locale selection, opt-in, or justification for restricting interaction to Chinese.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest description explicitly says the skill supports '获取登录二维码' (getting a login QR code). In this file, there is no tool call, function, CLI option, or exported API related to QR code retrieval; the implemented capabilities are limited to session initialization, login-status checking, and content publishing.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The configured title and body content are entirely in Chinese, indicating a fixed language choice in the generated/published material. The file does not present this as optional or user-selectable, so it may violate language/locale policy where user opt-in is required.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: SQP-3 applies to all file types and includes language/locale policy violations. This file presents all instructions exclusively in Chinese and does not indicate that the skill is region-specific or that users may choose another language, which can amount to forcing a specific language without opt-in.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: The help text describes '--check' as '仅检查登录状态' (only check login status). However, executing that mode first performs MCP session initialization via initializeSession(), which is an additional operation beyond the documented behavior.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.