T09 · Insecure Skill Coding Practices
Error
- Location
scripts/publish_xhs.js:48- Finding
Authentication Cookies Are Persisted in Plaintext Without Restrictive Permissions
- Content
View full analysis
- Remediation
View remediation
Security audit
Xhs Auto Publisher
Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed Xiaohongshu publishing automation workflow, but it uses persistent account sessions, anti-detection browser settings, excessive browser permissions, and scheduled automation in ways users should review carefully.
Review before installing if you are comfortable with local browser automation using your Xiaohongshu account. Treat the .auth directory as a secret, do not commit or sync it, and prefer a dedicated low-privilege workspace/profile. The publisher should remove anti-detection flags, unnecessary clipboard permissions, and no-sandbox settings, and should store cookies with owner-only permissions or avoid raw cookie persistence.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/render_slides.js:13- Finding
Untrusted HTML Is Rendered With JavaScript Enabled in an Unsandboxed Browser
- Content
View full analysis
document.fonts.ready); ``` The template places generated fields directly into HTML contexts, including fields explicitly intended to contain HTML or SVG: ```html{{COVER_SVG}}{{INTRO_BODY}}- {{P03_BULLETS}}
{{P03_QUOTE}}{{NEXT_PREVIEW}} ``` The template also performs an external network request during rendering: ```css @import url('https://fonts.googleapis.com/css2?family=Noto+Serif+SC:wght@500;700;900&family=Noto+Sans+SC:wght@400;500;700;900&display=swap'); ``` ### Technical Analysis `render_slides.js` treats the supplied document as active HTML rather than as inert presentation data. JavaScript is not disabled, no Content Security Policy is imposed, and no request interception restricts outgoing connections. The browser is additionally launched with both `--no-sandbox` and `--disable-setuid-sandbox`. The Skill workflow instr ...[truncated 2658 chars]- Remediation
View remediation
{ const url = new URL(request.url()); if (url.protocol === 'file:' && url.pathname === path.resolve(htmlPath)) { request.continue(); } else { request.abort(); } }); ``` 6. Bundle fonts locally rather than retrieving them from Google Fonts. This makes rendering reproducible and removes unnecessary network disclosure. 7. Add a restrictive Content Security Policy to generated slides, for example one that denies scripts, frames, objects, connections, and remote media. 8. Resolve and validate `htmlPath` against an approved workspace directory. Reject paths outside that directory and reject symbolic links where practical. 9. Run rendering in a dedicated low-privilege container or operating-system account with no access to authentication profiles or unrelated user files. ]]>
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/publish_xhs.js:81- Finding
Publishing Browser Uses Excessive Persistent Permissions and Disables Security Isolation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (14)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
A second description/behavior mismatch exists in the English-facing description: it presents a full content-production and publishing pipeline while the actual behavior appears narrower and different. Even when not directly exploitable as code execution, this is security-relevant because users may grant trust and permissions to a workflow that does not transparently describe its real data handling and automation behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
A second description/behavior mismatch exists in the English-facing description: it presents a full content-production and publishing pipeline while the actual behavior appears narrower and different. Even when not directly exploitable as code execution, this is security-relevant because users may grant trust and permissions to a workflow that does not transparently describe its real data handling and automation behavior.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill explicitly instructs use of anti-detection measures such as masking automation indicators, reusing persistent profiles, and mimicking human behavior to avoid platform risk controls. This is dangerous because it enables evasion of platform safeguards, facilitates unauthorized or policy-violating automation, and can help hide abuse at scale.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill lacks an explicit warning that it uses browser-automation techniques intended to reduce detection by platform controls. In this context, the omission is especially dangerous because the surrounding instructions normalize stealth automation for publishing, preventing informed consent and obscuring policy and account-abuse risks.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `SKILL.md`（本文件）
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The activation phrases are broad enough to match ordinary requests about Xiaohongshu setup or posting automation, which can cause the skill to trigger when the user did not clearly intend to invoke this automation workflow. Because the skill performs account-linked browser automation and scheduling, accidental invocation increases the risk of unintended collection of account details or setup of sensitive publishing actions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README explicitly describes persistent login state, local profile storage, and browser automation, but does not prominently warn users that these artifacts may contain reusable authentication material and account-identifying data. In a skill that automates access to a social-media account, unclear handling of cookies/profile state increases the chance of credential exposure, session theft, or unsafe copying/syncing of sensitive files.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 77% confidence
- Finding
The skill describes actions that rely on environment access and local filesystem/browser state, yet it declares no explicit tool scope or allowed-tools boundary. That increases the chance of overbroad execution, unintended access to local resources, and makes it harder for reviewers and users to understand what capabilities the skill actually needs.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest description includes a long list of trigger keywords such as “自媒体”, “日更”, “作品集”, and “账号运营”, which are broad phrases users may say in many contexts unrelated to this specific Xiaohongshu automation skill. Although the file later gives example intents, it does not clearly constrain activation boundaries or provide negative trigger examples for these keywords.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The description does not prominently warn that persistent cookies and browser profile data are stored locally for repeated automated use. This is dangerous because session artifacts are sensitive credentials; if mishandled, copied, or left on disk insecurely, they can enable account takeover or unauthorized posting.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The documentation claims the final publish action remains manual, but elsewhere it optimizes the automation to be hard to distinguish from a real human. That contradiction undermines the purported safety control and signals that the manual step may be more about evading detection than meaningfully preserving user oversight.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script persists authenticated Xiaohongshu session cookies to a predictable file under the workspace and explicitly aims for 'permanent login'. If that workspace is shared, synced, or readable by another local user/process, an attacker could reuse the cookies to hijack the account session without needing credentials or MFA.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The HTML document declares
lang="zh-CN", and the surrounding template text and slide copy are written exclusively in Chinese, indicating the skill is fixed to a specific language/locale. Under the policy, locale constraints should either offer user choice or be clearly documented as justified for a region-specific use case.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
All user-facing instructions, trigger phrases, and workflow descriptions are presented only in Chinese, and the README does not state that the skill is intentionally region- or language-specific or provide an opt-in language choice. Under the policy, forcing a specific language without user opt-in can be a natural-language policy concern.
- Content
Static analysis
No suspicious patterns detected.