xiaohongshu-mcp-openclaw

• Outcome: Review
• Latest audit: May 29, 2026 · 9:25 PM UTC
• Version: 1.0.0

Overview

The skill mostly does what it claims, but it asks users to run an account-backed local MCP service with broad install, auto-open, and optional persistence behaviors that deserve careful review.

Install only on a trusted machine. Prefer pinning XHS_MCP_VERSION before setup, keep the MCP service reachable only from localhost or protected by a firewall, avoid service_install.sh unless you truly need always-on behavior, set XHS_QR_AUTO_OPEN=0 if you want to review QR targets manually, and treat QR/login output and XHS session data as sensitive.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (20)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill invokes bash and python scripts, uses mcporter, reads and writes local files, and communicates with a remote MCP-backed service, but it declares no explicit permissions boundary for shell, file, or network access. This creates a trust gap: an agent or reviewer cannot accurately understand the skill's capabilities, increasing the risk of unintended command execution, data access, and network activity without informed consent or sandboxing.

Context-Inappropriate Capability

Medium

• Confidence: 76% confidence
• Finding: The README recommends installing a persistent system service (launchd/systemd user service) for a skill whose stated purpose is ad hoc XHS querying. Persisting a background service increases attack surface and creates long-lived local execution without clearly justifying why continuous execution is necessary, which can surprise users and outlive the session that requested the skill.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The script conditionally invokes the platform opener (`open`/`xdg-open`) on either a local QR image file or a URL derived from server-controlled login payload data. That introduces external application launch and browser-opening behavior not inherent to a query-only skill, and because the target can come from untrusted MCP output (`qr_url_hint`/parsed message), it can trigger unintended navigation or handler execution without explicit user confirmation.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: This script removes user launchd/systemd service definitions even though the skill’s declared purpose is XHS querying/scraping, not host service management. That mismatch expands the skill’s authority over the local system and creates unnecessary destructive capability that could remove arbitrary user services if inputs or environment variables are manipulated.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The code can disable and remove local launchd/systemd user services, which is privileged host-management behavior unrelated to the stated XHS data access workflow. In an agent skill context, this is dangerous because it gives the skill destructive control over local persistence mechanisms beyond what a user would reasonably expect.

Missing User Warnings

Low

• Confidence: 71% confidence
• Finding: The README describes syncing into persistent directories but does not prominently warn users that installation writes files outside the current checkout and may later be paired with background service installation. Insufficient disclosure can lead users to grant persistence they did not intend, which is especially relevant for agent skills that may be installed quickly from documentation.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The script writes decoded QR image data to a user-controlled path on disk automatically, creating a persistent artifact without notice or confirmation. While the content is expected to be a login QR code, this still creates privacy and local data-handling risk, especially in shared environments or when the output path is redirected to an unexpected location.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script auto-opens the saved QR file or a URL through the system desktop opener when `AUTO_OPEN=1` by default, without any user-facing disclosure at runtime. This can cause unexpected browser/app launches and, if the URL comes from untrusted login payload content, may expose the user to malicious or deceptive destinations or custom URI handler abuse.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This installer writes persistent service configuration under the user's account and enables an always-on background service without any interactive confirmation or explicit warning in the script itself. In a skill ecosystem, silent persistence increases risk because invoking the installer can create long-lived execution and data collection behavior the user may not realize they authorized.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: On macOS, the script disables a launchd service and deletes its plist file without any warning or confirmation. Silent destructive behavior increases the risk of accidental service removal and, because the label is partly environment-controlled, may be abused to target unintended user services.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: On Linux, the script disables the user systemd unit and deletes the unit file without prior notice or confirmation. In an agent-delivered skill, this is risky because users seeking XHS functionality would not expect local service deletion, and unit names are partially controllable through environment variables.

Session Persistence

Medium

• Category: Rogue Agent

Content

run_cmd "launchctl bootout gui/${uid}/${label} >/dev/null 2>&1 || true"
  run_cmd "launchctl bootstrap gui/${uid} '$plist_path'"
  run_cmd "launchctl enable gui/${uid}/${label}"
  run_cmd "launchctl kickstart -k gui/${uid}/${label}"

  echo "[OK] launchd service installed: $label"

• Confidence: 95% confidence
• Finding: launchctl enable

Session Persistence

Medium

• Category: Rogue Agent

Content

fi

  run_cmd "systemctl --user daemon-reload"
  run_cmd "systemctl --user enable --now '$unit_name'"

  echo "[OK] systemd user service installed: $unit_name"
  echo "[INFO] unit: $unit_path"

• Confidence: 96% confidence
• Finding: systemctl --user enable

Session Persistence

Medium

• Category: Rogue Agent

Content

uid="$(id -u)"
  label="${XHS_MCP_LAUNCHD_LABEL:-ai.openclaw.${SERVICE_NAME}}"
  plist_dir="$HOME/Library/LaunchAgents"
  plist_path="$plist_dir/${label}.plist"

  mkdir -p "$plist_dir" "$STATE_DIR" "$LOG_DIR"

• Confidence: 80% confidence
• Finding: plist

Session Persistence

Medium

• Category: Rogue Agent

Content

uid="$(id -u)"
  label="${XHS_MCP_LAUNCHD_LABEL:-ai.openclaw.${SERVICE_NAME}}"
  plist_dir="$HOME/Library/LaunchAgents"
  plist_path="$plist_dir/${label}.plist"

  mkdir -p "$plist_dir" "$STATE_DIR" "$LOG_DIR"

• Confidence: 80% confidence
• Finding: plist

Session Persistence

Medium

• Category: Rogue Agent

Content

uid="$(id -u)"
  label="${XHS_MCP_LAUNCHD_LABEL:-ai.openclaw.${SERVICE_NAME}}"
  plist_dir="$HOME/Library/LaunchAgents"
  plist_path="$plist_dir/${label}.plist"

  mkdir -p "$plist_dir" "$STATE_DIR" "$LOG_DIR"

• Confidence: 80% confidence
• Finding: plist

Session Persistence

Medium

• Category: Rogue Agent

Content

plist_dir="$HOME/Library/LaunchAgents"
  plist_path="$plist_dir/${label}.plist"

  mkdir -p "$plist_dir" "$STATE_DIR" "$LOG_DIR"

  local plist_content
  plist_content="$(cat <<EOF

• Confidence: 84% confidence
• Finding: plist

Session Persistence

Medium

• Category: Rogue Agent

Content

)"

  if [ "$DRY_RUN" = "1" ]; then
    echo "[DRYRUN] write plist to $plist_path"
  else
    printf "%s\n" "$plist_content" >"$plist_path"
  fi

• Confidence: 92% confidence
• Finding: plist

Session Persistence

Medium

• Category: Rogue Agent

Content

)"

  if [ "$DRY_RUN" = "1" ]; then
    echo "[DRYRUN] write plist to $plist_path"
  else
    printf "%s\n" "$plist_content" >"$plist_path"
  fi

• Confidence: 92% confidence
• Finding: plist

Session Persistence

Medium

• Category: Rogue Agent

Content

fi

  run_cmd "launchctl bootout gui/${uid}/${label} >/dev/null 2>&1 || true"
  run_cmd "launchctl bootstrap gui/${uid} '$plist_path'"
  run_cmd "launchctl enable gui/${uid}/${label}"
  run_cmd "launchctl kickstart -k gui/${uid}/${label}"

• Confidence: 95% confidence
• Finding: plist

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: config/mcporter.json:4