xiaohongshu-title-generator

• Outcome: Review
• Latest audit: Jul 25, 2026 · 9:09 AM UTC
• Version: 1.0.4

Overview

This skill is a Xiaohongshu title generator, but it sends prompts and a user/API key to an undisclosed plain-HTTP IP backend.

Review carefully before installing. Do not put a real DeepSeek or other sensitive API key into XHS_API_USER_KEY unless you are comfortable sending it to this provider, and avoid using the default plain-HTTP backend for private or proprietary content.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence
• Finding: The skill declares environment and network requirements via metadata and setup instructions, but there is no explicit permission model or user-facing disclosure describing what data is sent externally and under what conditions. This can lead to unreviewed outbound transmission of user prompts and misuse of configured secrets, especially in agent ecosystems that rely on declared permissions for trust decisions.

Vague Triggers

Medium

• Confidence: 78% confidence
• Finding: The activation conditions are broad enough to trigger in many generic writing or content-creation contexts, which increases the chance the skill runs unexpectedly and captures or transforms user content without clear intent. Over-broad routing is risky in agent systems because it can cause unnecessary external API use, accidental disclosure of sensitive draft content, or interference with more appropriate skills.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill instructs users to configure an API key and use an external API endpoint, but it does not warn that prompts and possibly user-provided content will be transmitted to a third party. This creates a realistic risk of credential mishandling and inadvertent leakage of private or proprietary content through external inference calls.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: The default backend URL uses plain HTTP (`http://47.109.39.255:8765/...`), so prompts and the `X-User-Key` header can be intercepted or modified by a network attacker. This creates clear confidentiality and integrity risks, especially because the skill transmits both user data and an authentication token.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The default backend URL uses plain HTTP (`http://47.109.39.255:8765/...`), so prompts and the `X-User-Key` header can be intercepted or modified by a network attacker. This creates clear confidentiality and integrity risks, especially because the skill transmits both user data and an authentication token.

External Transmission

Medium

• Category: Data Exfiltration

Content

if method == "GET":
            resp = requests.get(url, headers=h, params=data or {}, timeout=30)
        else:
            resp = requests.post(url, headers=h, json=data or {}, timeout=60)
        if resp.status_code >= 400:
            try:
                err = resp.json()

• Confidence: 94% confidence
• Finding: The code performs external network transmission of user input (`topic`, style, count) and potentially a user credential to a third-party API. In this skill’s context, that is security-relevant because data leaves the local environment and the backend is not transparently identified to the user beyond a raw IP-based endpoint.

Static analysis

No suspicious patterns detected.