T09 · Insecure Skill Coding Practices
Error
- Location
bin/xhs-pusher.mjs:93- Finding
Arbitrary Command Execution Through Shell Command Injection
- Content
View full analysis
- Remediation
View remediation
Security audit
xhs-skill-pusher
Security checks for vulnerabilities and agentic risk
Overview
This Xiaohongshu publishing skill is purpose-aligned but handles live account cookies and posting through unsafe scripts that could expose credentials or run unintended local commands.
Review carefully before installing. Use only a dedicated or test Xiaohongshu account, do not paste real cookies into shell commands, never commit cookie files or backups, and run the tool in an isolated workspace. The package should be fixed to use safe argument passing, strict file permissions, a .gitignore for credential files, pinned dependencies, and explicit warnings before live or scheduled posting.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/xhs_save_cookie.sh:75- Finding
Arbitrary Python Code Execution Through Source-Code Interpolation
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/xhs_save_cookie.sh:57- Finding
Path Traversal and Out-of-Directory Cookie File Writes
- Content
View full analysis
"$filepath" local user_id user_id=$(echo "$cookie_json" | python3 -c " import json, sys data = json.load(sys.stdin) user_id = next((c['value'] for c in data if c['name'] == 'x-user-id-creator.xiaohongshu.com'), 'unknown') print(user_id) ") success "Cookie saved: $filename" log " User ID: $user_id" log " Location: $filepath" if [[ "$set_active" == "true" ]]; then set_active_cookie "$filename" fi echo "$filepath" } ``` ```bash set_active_cookie() { local filename="$1" local source_file="$COOKIE_DIR/$filename" local active_file="$ACTIVE_FILE" if [[ ! -f "$source_file" ]]; then error "Cookie file does not exist: $source_file" return 1 fi ln -sf "$filename" "$active_file" } ``` ### Technical Analysis The `--name` and `--desc` values are used as pathname components without an allowlist or canonical-path containment check. Separator characters and `..` components can therefore influence the final destination. Although the output filename receives a date and `.json` suffix, traversal can still create or overwrite files outside `xhs_cookies` when the resulting parent directories exist. The redirection also follows symbolic links. If an attacker can pre-create or replace a destination entry with a symlink, the script m ...[truncated 1424 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/xhs_save_cookie.sh:128- Finding
Plaintext Session Cookies May Be Exposed Locally or Committed to Git
- Content
View full analysis
"$filepath" ``` Cookie data is also duplicated into the default file in `scripts/xhs_simple.sh:136-145`: ```python with open('$dst', 'w', encoding='utf-8') as f: json.dump(converted, f, ensure_ascii=False, indent=2) ``` The repository workflow recommends broad staging in `PUSH_GUIDE.md:95-101`: ```bash git pull origin main git add . git commit -m "feat: describe the change" git push origin main ``` ### Technical Analysis Xiaohongshu authentication cookies are bearer credentials capable of representing an authenticated account session. The scripts store these values as plaintext files using the process's ambient umask. They do not explicitly enforce owner-only permissions such as `0600`. The publishing workflow additionally creates or overwrites `cookies.json`, producing another plaintext copy. The reviewed project tree contains no `.gitignore`, while the maintenance guide instructs users to run `git add .`. The same guide permits the repository to be public or private. Consequently, generated cookie files, backups, raw cookie imports, or `cookies.json` can be staged and pushed accidentally. A private repository does not eliminate the risk because repository collaborators, compromised tokens, CI jobs, or later visibility changes may expose committed credentials. ### Attack Path Local disclosure path: 1. A user saves or activates a cookie. 2. The script writes it using the current umask. 3. On a permissively configured system, another local user or process can read the file. 4. The reader extracts authentication ...[truncated 1112 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:34- Finding
Unpinned and Non-Reproducible Third-Party Dependency Installation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (34)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明描述的核心功能是“小红书内容发布技能”，重点在 cookie 管理和 xhs-kit 自动化发布。但实际代码完全没有涉及小红书、cookie、xhs-kit、内容发布流程或相关 API 调用，而是执行 Git/GitHub 代码仓库推送操作。其主要目的与声明用途实质性不一致，且访问/操作的资源从预期的小红书发布环境变成了 GitHub 远程仓库，因此应判定为明显不匹配。
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node ./bin/xhs-pusher.mjs --help
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node ./bin/xhs-pusher.mjs --help
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node ./bin/xhs-pusher.mjs --help
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node ./bin/xhs-pusher.mjs --help
YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]
High
- Category
- YARA Match
- Confidence
- 75% confidence
- Finding
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
- Content
--switch new_account
text ## 生产环境建议 ### 每日发布脚本 ```bash #!/bin/bash # daily_publish.sh DATE=$(date +%Y-%m-%d) ./xhs.sh \ --cookie cookies.json \ --title "每日更新 $DATE" \ --content "今日分享..." \ --image "/path/to/images/${DATE}.jpg" \ --tag 每日更新 \ --tag 生活记录 echo "$(date): 发布成功" >> /var/log/xhs_publish.log添加到crontab
bash # 每天10点发布 0 10 * * * cd /Users/Zhuanz/.openclaw/workspace && ./xhs.sh --cookie cookies.json --title "早安" --content "..." --image morning.jpg # 每天20点发布 0 20 * * * cd /Users/Zhuanz/.openclaw/workspace && ./xhs.sh --cookie cookies.json --title "晚安" --content "..." --image night.jpg🎯 记住关键点
- 永远使用
--cookie参数指定文件 - 脚本会自动转换cookie格式
- 先debug验证，再实际发布
- 多账号用
--switch切换
📞 需要帮助？
bash # 查看完整帮助 ./xhs.sh --help # �- 永远使用
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The guide explicitly instructs users to push a repository for a skill centered on cookie management and automation, including the option to make the repository public, but it does not warn about the risk of accidentally committing authentication cookies, local config files, or publishing scripts containing sensitive session data. In the context of a Xiaohongshu posting skill, leaked cookies could allow account takeover or unauthorized posting, making this a real security weakness in the documentation even if no secret is directly shown in this file.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README encourages centralized storage and routine handling of live account cookies but does not warn that these cookies are authentication secrets equivalent to account credentials. In a skill specifically built for automated posting, this omission increases the chance that users will store, share, or commit reusable session tokens insecurely, leading to account takeover or misuse if the files are exposed.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The README provides one-command publishing workflows without clearly warning that these commands act on real authenticated accounts and can create live posts, alter account state, or trigger platform enforcement. In the context of a social-media publishing skill, users may test commands against production accounts by default, causing unintended content publication or policy violations.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill advertises file-based cookie management and explicitly instructs users to create, copy, back up, and symlink credential files, but it does not declare any tool scope or permissions. That mismatch weakens least-privilege controls and can cause an agent to perform file reads/writes on sensitive credential material without clear user visibility or policy gating.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The documentation encourages collecting, storing, reusing, backing up, and switching authenticated cookie files for a real user account, but only gives a brief note about permissions and does not clearly warn about account takeover, session hijacking, privacy leakage, or policy/compliance risks. In this skill context, cookies are the core authentication mechanism, so normalizing long-term local storage materially increases the blast radius if files are exposed or mishandled.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The manifest describes a skill for Xiaohongshu publishing with cookie management and xhs-kit-based automation, but this file implements that by invoking arbitrary local shell scripts via child_process.execSync. Spawning shell commands and requiring users to copy executable scripts from ~/.openclaw/workspace introduces a general code-execution capability that is not explicitly justified by the stated purpose itself.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The cookie save command accepts raw session cookie material on the command line and interpolates it into a shell command. This exposes credentials to shell history and process inspection, and unsafe shell construction can let specially crafted cookie values inject additional commands.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The publish command forwards user-controlled title, content, tags, image paths, scheduling data, and cookie paths into a shell command that executes an external script. Besides undisclosed transmission of sensitive/authenticated content, this creates a strong command-injection risk if any argument contains shell metacharacters, potentially leading to arbitrary local command execution.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The quick-start repeatedly instructs users to pass cookie JSON files directly to publishing commands and even names active/backup account cookie files, but it never warns that these files are bearer authentication material equivalent to logged-in session tokens. In practice this encourages insecure handling, copying, and storage of account credentials and increases the chance of account takeover if the files are exposed through logs, backups, repos, or shared workspaces.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The cron examples schedule unattended execution of live posting commands against a real account without emphasizing that these are real account actions or advising safeguards. This can cause unintended or repeated posts, misuse on the wrong account, and persistent automated activity if a machine is shared or the schedule is forgotten.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The document instructs users to store and use live authentication cookies from JSON files for account publishing, but the safety guidance is minimal and appears much later. Cookies are effectively bearer tokens for the associated Xiaohongshu accounts, so mishandling them can enable account takeover, unauthorized posting, privacy exposure, and cross-account misuse.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The backup instructions tell users to archive all cookie files into a tar.gz without any requirement to encrypt the archive or store it in a protected location. Because the archive would contain reusable session cookies for multiple accounts, anyone who obtains the backup could restore active sessions and publish or access accounts without the original credentials.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The package description is written entirely in Chinese ("小红书内容发布技能 - 规范化cookie管理 + xhs-kit自动化发布") and provides no indication that users may choose another language or locale. Under the stated policy, hard-coding a single language without opt-in can be a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The user-facing comments and console output are written entirely in Chinese, which effectively forces a specific language for anyone using the skill. Under the policy, locale or language constraints should either be optional for the user or clearly justified as region-specific.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The
infocommand prints sensitive cookie fields such as access tokens, session identifiers, and other authentication values to the terminal, only truncating them rather than masking them. Terminal output is often captured in scrollback, recordings, logs, screenshots, or shared shells, so exposing even partial token values materially increases credential leakage risk in a publishing automation workflow.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script copies the active cookie file into a default working file (
cookies.json), duplicating live authentication material in a predictable location. This increases the chance of accidental disclosure through other tools, commits, backups, or weaker filesystem permissions, especially because these cookies appear sufficient to act as a logged-in XiaoHongShu session.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script persists live authentication cookies to disk as JSON files and even creates an active symlink, but it does not warn the user that these are bearer credentials equivalent to account access. In this skill context, the cookies are specifically for automating Xiaohongshu publishing, so compromise of these files could allow unauthorized posting, account takeover actions within the session scope, or reuse of authenticated state by other local users/processes.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The script converts and writes authentication cookies into a fixed local file name (
cookies.json) without prompting before overwrite, setting restrictive permissions, or warning that sensitive credentials are being materialized on disk. In this skill’s context, those cookies are the account’s live publishing credentials, so accidental overwrite, unintended reuse, or exposure via other local processes/tools can lead to account takeover or unauthorized posting.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The guide forces a single language presentation throughout the file, and there is no indication that users may choose another language or that the skill is intended only for a Chinese-language audience. Under the stated policy, fixed language behavior without user opt-in can be a natural-language policy violation.
- Content