ClawHub
Back to skill

Security audit

xiaohongshu-mcp-openclaw

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent Xiaohongshu data-query purpose, but it also installs and runs unpinned external executables and offers persistent auto-start services with unsafe shell handling.

Review this before installing. Use the on-demand query flow only if possible, avoid service_install.sh unless you intentionally want a background service that starts across sessions, set XHS_QR_AUTO_OPEN=0 if you do not want files or URLs opened automatically, and prefer pinned/verified dependency versions before running setup on a sensitive machine.

A.I.G

Vulnerability Patterns
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T06 · System Persistence

Error
Location
scripts/service_install.sh:35
Finding

Persistent Auto-Start Service with Continuous Restart

Content
View full analysis
Label ${label} ProgramArguments ${MCP_BIN} -headless=${HEADLESS} -port :${PORT} WorkingDirectory ${STATE_DIR} RunAtLoad KeepAlive StandardOutPath ${LOG_FILE} StandardErrorPath ${LOG_FILE} EnvironmentVariables HOME ${HOME} PATH ${PATH} EOF )" if [ "$DRY_RUN" = "1" ]; then echo "[DRYRUN] write plist to $plist_path" else printf "%s\n" "$plist_content" >"$plist_path" fi run_cmd "launchctl bootout gui/${uid}/${label} >/dev/null 2>&1 || true" run_cmd "launchctl bootstrap gui/${uid} '$plist_path'" run_cmd "launchctl enable gui/${uid}/${label}" run_cmd "launchctl kickstart -k gui/${uid}/${label}" } ``` ```bash install_linux() { local user_dir unit_name unit_path user_dir="${XDG_CONFIG_HOME:-$HOME/.config}/systemd/user" unit_name="${XHS_MCP_SYSTEMD_UNIT:-${SERVICE_NAME}.service}" unit_path="$user_dir/$unit ...[truncated 2875 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/service_install.sh:24
Finding

Shell Command Injection Through Environment-Controlled Service Names and eval

Content
View full analysis
/dev/null 2>&1 || true" run_cmd "launchctl bootstrap gui/${uid} '$plist_path'" run_cmd "launchctl enable gui/${uid}/${label}" run_cmd "launchctl kickstart -k gui/${uid}/${label}" ``` ```bash unit_name="${XHS_MCP_SYSTEMD_UNIT:-${SERVICE_NAME}.service}" ``` ```bash run_cmd "systemctl --user daemon-reload" run_cmd "systemctl --user enable --now '$unit_name'" ``` From `scripts/service_uninstall.sh`: ```bash run_cmd() { if [ "$DRY_RUN" = "1" ]; then echo "[DRYRUN] $*" return 0 fi eval "$@" } ``` ```bash label="${XHS_MCP_LAUNCHD_LABEL:-ai.openclaw.${SERVICE_NAME}}" plist_path="$HOME/Library/LaunchAgents/${label}.plist" run_cmd "launchctl disable gui/${uid}/${label} >/dev/null 2>&1 || true" run_cmd "launchctl bootout gui/${uid}/${label} >/dev/null 2>&1 || true" run_cmd "rm -f '$plist_path'" ``` ```bash unit_name="${XHS_MCP_SYSTEMD_UNIT:-${SERVICE_NAME}.service}" unit_path="$user_dir/$unit_name" if command -v systemctl >/dev/null 2>&1; then run_cmd "systemctl --user disable --now '$unit_name' >/dev/null 2>&1 || true" run_cmd "systemctl --user daemon-reload >/dev/null 2>&1 || true" fi run_cmd "rm -f '$unit_path'" ``` ### Technical Analysis The `run_cmd` function accepts a constructed string and passes it to `eval`. This causes the shell to parse the command a second time. Values derived from the positional `SERVICE_NAME` argument and environment variables such as `XHS_MCP_LAUNCHD_LABEL` and `XHS_MCP_SYSTEMD_UNIT` are interpol ...[truncated 1764 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
scripts/setup.sh:4
Finding

Unpinned Third-Party Executables Installed and Run by the Skill

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (57)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill's stated purpose is content retrieval, but the documented lifecycle also includes service stop/disable and deletion of local service configuration files. Destructive local service-management behavior is materially more sensitive than query operations, and users may not expect a social-data skill to alter or remove local service state.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill's stated purpose is content retrieval, but the documented lifecycle also includes service stop/disable and deletion of local service configuration files. Destructive local service-management behavior is materially more sensitive than query operations, and users may not expect a social-data skill to alter or remove local service state.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The skill's stated purpose is content retrieval, but the documented lifecycle also includes service stop/disable and deletion of local service configuration files. Destructive local service-management behavior is materially more sensitive than query operations, and users may not expect a social-data skill to alter or remove local service state.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The skill's stated purpose is content retrieval, but the documented lifecycle also includes service stop/disable and deletion of local service configuration files. Destructive local service-management behavior is materially more sensitive than query operations, and users may not expect a social-data skill to alter or remove local service state.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The skill's stated purpose is content retrieval, but the documented lifecycle also includes service stop/disable and deletion of local service configuration files. Destructive local service-management behavior is materially more sensitive than query operations, and users may not expect a social-data skill to alter or remove local service state.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill's stated purpose is content retrieval, but the documented lifecycle also includes service stop/disable and deletion of local service configuration files. Destructive local service-management behavior is materially more sensitive than query operations, and users may not expect a social-data skill to alter or remove local service state.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill's stated purpose is content retrieval, but the documented lifecycle also includes service stop/disable and deletion of local service configuration files. Destructive local service-management behavior is materially more sensitive than query operations, and users may not expect a social-data skill to alter or remove local service state.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/build_distribution.sh (reported line 28)May include surrounding context.

sh
cp -R "$entry" "$STAGE_DIR/$SKILL_NAME/"
done
shopt -u dotglob
rm -rf "$STAGE_DIR/$SKILL_NAME/.git" || true
rm -rf "$STAGE_DIR/$SKILL_NAME/dist" || true
find "$STAGE_DIR/$SKILL_NAME" -type d -name "__pycache__" -prune -exec rm -rf {} +
find "$STAGE_DIR/$SKILL_NAME" -name ".DS_Store" -delete

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/build_distribution.sh (reported line 29)May include surrounding context.

sh
done
shopt -u dotglob
rm -rf "$STAGE_DIR/$SKILL_NAME/.git" || true
rm -rf "$STAGE_DIR/$SKILL_NAME/dist" || true
find "$STAGE_DIR/$SKILL_NAME" -type d -name "__pycache__" -prune -exec rm -rf {} +
find "$STAGE_DIR/$SKILL_NAME" -name ".DS_Store" -delete

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/install_to_openclaw.sh (reported line 24)May include surrounding context.

sh
mkdir -p "$(dirname "$dst")"
    rm -rf "$dst"
    cp -R "$BASE_DIR" "$dst"
    rm -rf "$dst/.git" || true
    rm -rf "$dst/dist" || true
    find "$dst" -type d -name "__pycache__" -prune -exec rm -rf {} +
    find "$dst" -name ".DS_Store" -delete

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/install_to_openclaw.sh (reported line 25)May include surrounding context.

sh
rm -rf "$dst"
    cp -R "$BASE_DIR" "$dst"
    rm -rf "$dst/.git" || true
    rm -rf "$dst/dist" || true
    find "$dst" -type d -name "__pycache__" -prune -exec rm -rf {} +
    find "$dst" -name ".DS_Store" -delete
  )

MCP Config Access

High
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.

Content

Scanner excerpt · scripts/xhs_mcp_client.py (reported line 5)May include surrounding context.

python
"""Unified client for xpzouying/xiaohongshu-mcp through mcporter.

Features:
- Discover available MCP tool names dynamically.
- Search notes by keyword.
- Fetch note detail and comments by note id.
- Normalize commonly used fields (title, author, like/comment counts).

Session Persistence

Medium
Category
Rogue Agent
Confidence
80% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 172)May include surrounding context.

Q10: 常驻服务怎么装？

bash
# macOS: launchd
bash scripts/service_install.sh xiaohongshu-mcp
bash scripts/service_status.sh xiaohongshu-mcp

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding

The skill declares broad operational behavior through shell, file, and network-capable commands but does not define any explicit tool scope or permission boundaries. In an agent environment, this increases the chance that the skill can invoke high-risk actions such as filesystem changes, package installation, service management, and network access without clear user-consented constraints.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill description advertises scraping notes, comments, and engagement metrics but does not warn about privacy, platform terms, account risk, or handling of collected data. This omission can lead users to deploy scraping workflows without understanding legal, policy, or personal-data implications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The installation and service-management instructions can create persistent local changes, including package installation, copied skill files, and long-running services, without prominently warning users of those effects. Hidden persistence and system modification are risky in agent ecosystems because they exceed the expectations of a simple data-query skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The installer unconditionally deletes the destination directory with rm -rf "$dst" before copying, with no confirmation, backup, or safety guard beyond basic name checks on SKILL_NAME. Because the target path is partially user-controlled via the script argument and environment-derived roots, a misconfigured or unexpected destination can cause destructive data loss in user directories.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script writes QR login material to a local file and can launch a host application to open that file or a URL, which exceeds the skill's stated query-only data retrieval scope. In an agent setting, filesystem writes and host-app launching are sensitive side effects because they create persistence on disk and trigger external actions without an explicit confirmation boundary in this script.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The script decodes QR image data and writes it to a persistent path under the user's home directory without any user-facing disclosure in the script itself. While the content is not necessarily highly sensitive, writing authentication-related artifacts to disk can leave residual data, surprise users, and create privacy or operational concerns on shared systems.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The script invokes platform openers (open/xdg-open) on a file path or URL derived from upstream login payload handling. Even if intended for convenience, launching external applications is a privileged host action that can surprise users, expand attack surface, and cause navigation to untrusted content if the upstream server or payload is compromised.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The script automatically opens the generated QR file or URL when AUTO_OPEN is enabled by default, without a user-facing warning or confirmation. In an agent context, this is a significant side effect because it causes immediate host interaction and may expose the user to unexpected browser/app launches or untrusted remote content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The script writes the full collected report, including note metadata and comment content, to a predictable location under /tmp by default without explicit user confirmation. On multi-user systems or shared environments, temporary files can be exposed to other local users, retained longer than expected, or accidentally consumed by other processes, which creates a confidentiality and data-handling risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The script creates persistent launchd/systemd configuration and corresponding state/log directories without an explicit upfront warning or confirmation. In an agent skill context, persistence materially changes the trust boundary because running the installer causes the service to survive beyond the current session and auto-start later, which can surprise users and expand the window for abuse if the backing MCP server is unsafe or compromised.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/service_install.sh (reported line 44)May include surrounding context.

sh
local plist_content
  plist_content="$(cat <<EOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
 "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>

Session Persistence

Medium
Category
Rogue Agent
Confidence
90% confidence
Finding

Writing the plist file into ~/Library/LaunchAgents creates a persistent service definition that launchd can later load automatically. In this skill context, creating per-user persistence for a scraping/network service is security-relevant because it extends execution beyond the user's immediate task and may be unexpected.

Content

Scanner excerpt · scripts/service_install.sh (reported line 80)May include surrounding context.

sh
)"

  if [ "$DRY_RUN" = "1" ]; then
    echo "[DRYRUN] write plist to $plist_path"
  else
    printf "%s\n" "$plist_content" >"$plist_path"
  fi

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
config/mcporter.json:4