T09 · Insecure Skill Coding Practices
Warning
- Location
xhs-keepalive.py:229- Finding
Authenticated Browser State Is Saved Without Restrictive File Permissions
- Content
View full analysis
- Remediation
View remediation
Security audit
Xiaohongshu Search
Security checks for vulnerabilities and agentic risk
Overview
The skill appears to perform the advertised Xiaohongshu scraping, but it requires live login cookies and persists session/token data with weak containment.
Install only if you are comfortable giving the skill a live Xiaohongshu session. Prefer a dedicated account, keep cookie and data directories outside shared repos/backups, enforce owner-only permissions, delete data/state/token caches after use, and avoid running it on shared hosts or CI logs where command arguments and output may be captured.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T09 · Insecure Skill Coding Practices
Warning
- Location
xhs-harvest.py:247- Finding
Session-Derived Access Tokens and Authenticated Content Are Persisted With Default Permissions
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
xhs-fetch.py:334- Finding
Short-Lived Access Tokens Are Exposed in Process Arguments and Console Output
- Content
View full analysis
和 --user-id ', hint='提示: 从 xhs-fetch.py user 拿主页,那里有 xsec_token + xsec_source') return 1 # xsec_source 必须为 pc_user (主页里的 token 都是这个) url = f"{WEB_BASE}/user/profile/{args.user_id}/{note_id}?xsec_token={args.token}&xsec_source=pc_user" print(f"Opening (via-user-profile): {url}") elif args.via_search: if not args.token: err_struct('parse_fail', '--via-search 需要 --token ', hint='提示: 先跑 `xhs-fetch.py search ` 拿 note 的 xsec_token') return 1 # search_result 路径默认 xsec_source=pc_note xsrc = args.xsec_source or 'pc_note' url = f"{WEB_BASE}/search_result/{note_id}?xsec_token={args.token}&xsec_source={xsrc}" print(f"Opening (via-search): {url}") ``` The harvester passes tokens through a child process's argument vector: ```python # 构造 note 命令参数 note_args = ['note', note_id, '--token', xsec_token, '--comments', str(comments), '--out', str(out_path)] if user_id: note_args += ['--via-user-profile', '--user-id', user_id] else: note_args.append('--via-search') if xsec_source: note_args += ['--xsec-source', xsec_source] rc, out, err_out = run_fetch(note_args) ``` ### Technical Analysis Command-line arguments may be visible through process inspection facilities, monitoring agents, diagnostic tooling, shell history, or process-accounting systems. The fetcher also prints complete token-bearing URLs to standard output, where they can be captured by terminal logs, CI log ...[truncated 1485 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
docs/pitfalls.md:58- Finding
Troubleshooting Guidance Uses Overly Broad Forced Process Termination
- Content
View full analysis
- Remediation
View remediation
/dev/null || true ``` 4. If PID tracking is unavailable, narrow process matching to a unique state directory, profile directory, or exact daemon command line rather than matching all Chrome and Chromium processes. 5. Add a prominent warning that broad process matching can terminate unrelated browser sessions. 6. Remove language describing forced termination as a universal solution. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (34)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The skill metadata understates sensitive behaviors such as session/cookie management, local credential file handling, and anti-abuse/risk checks, while the documented core operations depend on those mechanisms. When a skill omits these security-relevant behaviors from its declared purpose, operators may enable it without understanding that it processes authenticated session material and persistent local state.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill metadata understates sensitive behaviors such as session/cookie management, local credential file handling, and anti-abuse/risk checks, while the documented core operations depend on those mechanisms. When a skill omits these security-relevant behaviors from its declared purpose, operators may enable it without understanding that it processes authenticated session material and persistent local state.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill explicitly requires users to supply authenticated Xiaohongshu cookies and browser fingerprint values so the tool can reuse a live logged-in session. Reusing session tokens outside the browser creates a high-value credential handling path: leakage of these files or logs could enable account takeover, impersonation, or abuse of the user's authenticated access.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The setup instructions tell users to copy all browser cookies via developer tools and save them into a local file consumed by the skill. This encourages bulk extraction of sensitive session material, potentially including more tokens than necessary, and normalizes unsafe credential handling that could expose the account if the file is read, backed up insecurely, or exfiltrated by another tool.
- Content
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
bash # 1. 看 IP / 城市 curl -s "https://ipinfo.io/json" | python3 -m json.tool | head -10 # 2. 看 agent-browser 当前 cookies agent-browser cookies get
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The document is written primarily in Chinese and does not offer an English alternative or indicate that the skill is intentionally limited to a Chinese-speaking contributor base for a documented regional reason. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The file's instructional and descriptive content is written entirely in Chinese, including contributor guidance, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-only audience. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README explicitly instructs users to export live Xiaohongshu authentication cookies from their browser and store them locally in a plaintext file. Those cookies appear sufficient to impersonate the user session, so compromise of the file, accidental inclusion in logs/backups, or reuse by the skill beyond user expectations could enable account takeover or access to private account data.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 86% confidence
- Finding
The skill declares no explicit tool scope or permission boundaries despite clearly requiring environment access, filesystem reads/writes, network access, and shell execution. In an agent setting, this weakens least-privilege controls and makes it easier for the skill to be invoked with broader capabilities than users may reasonably expect.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The manifest description is entirely in Chinese and presents the skill purpose and requirements only in that language. Under the policy, locale or language constraints should not be imposed without user opt-in or a clearly documented justification, and this file does not offer either.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The operational instructions, warnings, examples, and troubleshooting sections are all presented only in Chinese. This creates a natural-language policy issue because users are not offered a language choice, and no explicit justification for a Chinese-only interface is stated.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The entire skill document is written in Chinese and includes user-facing operational guidance without any indication that language selection is optional or that the skill is intended only for a Chinese-speaking audience. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The script automatically checks for and loads authenticated browser cookies into agent-browser without a clear runtime warning or consent step. In a skill explicitly designed to scrape Xiaohongshu using a logged-in session, this creates real credential/privacy risk because the tool can act with the user's authenticated account and access account-linked content.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python r = run(['agent-browser', 'cookies', 'get'], timeout=10) if not r.stdout.strip() or 'web_session' not in r.stdout: print("Loading cookies into agent-browser...") subprocess.run( ['python3', str(Path(__file__).parent / 'xhs-keepalive.py'), 'load'], timeout=30 )
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The code reads document.cookie and extracts a session-linked user identifier from the browser context to influence scraping logic. Even though it only targets a specific cookie value, accessing browser cookies from automation code is sensitive and can expose or misuse authenticated session metadata without clear disclosure.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This Python file contains user-facing natural-language instructions, help text, status output, and report content entirely in Chinese, starting from the module docstring and continuing through the CLI experience. Under the policy rule, forcing a specific language without offering the user a language/locale option is a natural-language policy violation.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python 不要在 stdout/stderr 里字符串 grep (脆弱,fetch 改字面量 harvest 就漏判)。 """ cmd = ['python3', str(FETCH_SCRIPT)] + args r = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout) return r.returncode, r.stdout, r.stderr
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python 不要在 stdout/stderr 里字符串 grep (脆弱,fetch 改字面量 harvest 就漏判)。 """ cmd = ['python3', str(FETCH_SCRIPT)] + args r = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout) return r.returncode, r.stdout, r.stderr
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md 注意: - 不依赖任何第三方库 (除 agent-browser 自身) - cookies 必须 chmod 600 (含 web_session + id_token 等敏感字段) - xhs cookie 6-12 小时会失效 (web_session 短效),需要定期重导 """
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md 注意: - 不依赖任何第三方库 (除 agent-browser 自身) - cookies 必须 chmod 600 (含 web_session + id_token 等敏感字段) - xhs cookie 6-12 小时会失效 (web_session 短效),需要定期重导 """
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md 注意: - 不依赖任何第三方库 (除 agent-browser 自身) - cookies 必须 chmod 600 (含 web_session + id_token 等敏感字段) - xhs cookie 6-12 小时会失效 (web_session 短效),需要定期重导 """
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
python 注意: - 不依赖任何第三方库 (除 agent-browser 自身) - cookies 必须 chmod 600 (含 web_session + id_token 等敏感字段) - xhs cookie 6-12 小时会失效 (web_session 短效),需要定期重导 """
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
python 注意: - 不依赖任何第三方库 (除 agent-browser 自身) - cookies 必须 chmod 600 (含 web_session + id_token 等敏感字段) - xhs cookie 6-12 小时会失效 (web_session 短效),需要定期重导 """
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python return 1 # 清掉旧的 subprocess.run(['agent-browser', 'cookies', 'clear'], capture_output=True, text=True) # 读 Netscape
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 83% confidence
- Finding
The subprocess call itself is safely parameterized, but it forwards sensitive cookie names and values into command-line arguments. On many systems, command-line arguments can be exposed to other local processes/users through process listings, logs, crash reports, or audit tooling, which can leak authenticated session tokens such as web_session and id_token.
- Content
python continue domain, include_subdomain, path, secure, expires, name, value = parts[:7] flags = _cookie_to_agent_browser_flags(name) r = subprocess.run( ['agent-browser', 'cookies', 'set', name, value] + flags, capture_output=True, text=True )