小红书发布

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:29 AM UTC
• Version: 1.0.0

Overview

This is a real Xiaohongshu publishing skill, but it asks users to run unverified external software and includes live-posting flows without strong safeguards.

Install only if you trust the MCP server source and can verify the executable and npm package provenance. Use a non-admin account, avoid sensitive/private images or text, confirm the target Xiaohongshu account before publishing, and do not run the bundled publish_*.js examples unless you intentionally want their hardcoded content posted publicly.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:16
• Finding: Unpinned and Unverified Third-Party Dependencies<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:16-23`, `SKILL.md:30-34`, and `references/config.md:32-37` **Vulnerability Type**: Unverified third-party package and executable installation **Risk Level**: Medium ### Vulnerable Code Snippets From `SKILL.md`: ```markdown 1. **Xiaohongshu MCP server** - File: `xiaohongshu-mcp-windows-amd64.exe` - Port: 18060 - Startup method: Run the executable 2. **mcporter CLI** ```bash npm install -g mcporter ``` ``` ```powershell # Run from the xiaohongshu-mcp directory .\xiaohongshu-mcp-windows-amd64.exe ``` From `references/config.md`: ```powershell cd C:\Users\90781\.openclaw\workspace\xiaohongshu-mcp-1 .\xiaohongshu-mcp-windows-amd64.exe ``` ### Technical Analysis The installation instructions direct users to install `mcporter` globally from the npm registry without pinning an exact version or requiring package integrity verification. A global npm installation can execute package lifecycle scripts with the privileges of the invoking user and places package-provided executables in a globally accessible location. The instructions also direct users to execute `xiaohongshu-mcp-windows-amd64.exe` without specifying a fixed release, trusted HTTPS download location, cryptographic checksum, or digital-signature verification procedure. Consequently, users cannot reliably confirm that the executable is the reviewed and intended component. The included implementation in `scripts/publish.js` communicates directly with the local MCP service using Node.js HTTP APIs and does not invoke `mcporter`. The global CLI installation therefore increases supply-chain exposure without being necessary for the included publishing workflow. ### Attack Path 1. An attacker compromises the relevant npm package, its maintainer account, the registry distribution path, or a dependency used by the package. 2. Alternatively, an attacker substitutes a malicious file for `xiaohongshu-mcp-windows-amd64.exe` through ...[truncated 1355 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `mcporter` from the prerequisites unless it is required by a documented workflow. The included publishing script already communicates directly with the MCP endpoint. 2. If `mcporter` must remain: - Pin a specific reviewed version, such as `mcporter@<reviewed-version>`. - Prefer a project-local development dependency instead of a global installation. - Use a lockfile with integrity metadata. - Disable lifecycle scripts during installation when compatible with the package. - Document the official package owner and registry source. 3. Pin the MCP server to a specific reviewed release and provide its official HTTPS download URL. 4. Publish the expected SHA-256 checksum and require users to verify it before execution. 5. Require verification of the executable's digital signature and expected publisher identity. 6. Advise users to run the service as a non-administrative account with access limited to the image files and resources needed for publishing. 7. Document a secure upgrade process that requires review and integrity verification before changing dependency versions. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: 代码的核心功能与声明的大方向基本一致：它确实用于小红书内容发布，并支持检查登录状态。具体实现上，它通过向 localhost:18060 的 MCP 服务发送 JSON-RPC 请求，调用 check_login_status 和 publish_content 工具；同时读取本地文件系统仅用于检查图片路径是否存在，这属于发布功能的合理支持细节，不构成额外高风险未声明能力。主要不一致在于：声明明确写了“获取登录二维码”，但代码没有任何获取二维码的函数、命令行参数或工具调用；另外声明强调“批量发布、定时发布等”使用场景，而当前代码只支持单次调用发布，未见批量调度或定时机制。因此描述相较代码存在实质性过度声明，应判定为不匹配。

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill automates posting content to a third-party platform and necessarily transmits user-supplied text and image data over the network, but the description does not clearly warn users about that external data transfer. This can lead to accidental disclosure of sensitive content or unintended publication from the user's account because users may treat the skill as local-only automation.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The example publish commands are presented as routine usage without a clear warning that they will create real posts on the user's Xiaohongshu account. In an automation context, this increases the chance of unintended live actions, reputational harm, and accidental posting of test or sensitive content, especially because the skill is designed for batch and repeated use.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The visible content is entirely in Chinese, including the main heading, subtitle, and call to action. Under the policy, forcing a specific language without user opt-in or a documented region-specific justification is a natural-language policy violation.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The post title, body text, examples, and success messages are all hard-coded in Chinese, which imposes a specific language/locale on the generated publication flow. There is no visible user opt-in, language selection, or documentation that this skill is intentionally limited to a Chinese-language audience.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: This script performs a real publish action immediately by calling publish(config) when the file is run, and there is no confirmation prompt, dry-run mode, or visible user acknowledgement in this file. In the context of a skill designed for automated Xiaohongshu posting, that means content can be posted accidentally, unexpectedly, or as part of a larger automated workflow without an explicit final consent step.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The post title, body, and tags are hard-coded entirely in Chinese, which indicates the skill produces output in a specific language with no visible user opt-in or language-selection mechanism. This matches the policy category for language or locale constraints that are imposed without user choice.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The document gives direct instructions for publishing content and checking login state via local cookies, but it does not clearly warn that these actions can affect a real user account and may post content publicly. In an automation skill for a social platform, missing safety and consent warnings increases the chance of accidental or unauthorized posting, especially in batch or scheduled workflows.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The skill’s description and all user-facing CLI messages are hardcoded in Chinese, indicating a fixed language choice for operation. This is a natural-language policy concern because the script does not offer any locale selection, opt-in, or justification for restricting interaction to Chinese.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The manifest description explicitly says the skill supports '获取登录二维码' (getting a login QR code). In this file, there is no tool call, function, CLI option, or exported API related to QR code retrieval; the implemented capabilities are limited to session initialization, login-status checking, and content publishing.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: The configured title and body content are entirely in Chinese, indicating a fixed language choice in the generated/published material. The file does not present this as optional or user-selectable, so it may violate language/locale policy where user opt-in is required.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: SQP-3 applies to all file types and includes language/locale policy violations. This file presents all instructions exclusively in Chinese and does not indicate that the skill is region-specific or that users may choose another language, which can amount to forcing a specific language without opt-in.

Intent-Code Divergence

Low

• Confidence: 76% confidence
• Finding: The help text describes '--check' as '仅检查登录状态' (only check login status). However, executing that mode first performs MCP session initialization via initializeSession(), which is an additional operation beyond the documented behavior.

Static analysis

No suspicious patterns detected.