xiaohongshu-full-auto

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:33 AM UTC
• Version: 1.0.0

Overview

This skill is a social-media autopublishing workflow that asks for account cookies and can post content, but its publication controls, third-party data source, and local logging are not clearly bounded or disclosed.

Review before installing. Do not provide a real Xiaohongshu cookie unless you understand that it may allow account access and posting. Prefer draft or semi-automatic use, verify any generated content before publication, replace or approve the third-party hot-topic source, pin dependencies, and move publication logs into a documented project-owned output directory.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:52

Finding

Unpinned Third-Party Dependencies Create Supply-Chain Risk

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/get_hot_topics.py:30

Finding

Undocumented Third-Party Service Controls Downstream Topic Data

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Note

• Location: scripts/logger.py:12

Finding

Publication Metadata Is Written Outside the Project Boundary

Content

View full analysis

None: """Record one publication entry.""" log_dir = os.path.dirname(LOG_FILE) if not os.path.exists(log_dir): os.makedirs(log_dir) with open(LOG_FILE, 'a', encoding='utf-8') as f: f.write(json.dumps(record, ensure_ascii=False) + '\n') ``` ### Technical Analysis The source uses a relative path containing two parent-directory components. From `artifact/scripts/logger.py`, `../../published.jsonl` resolves to the parent of the project directory rather than a project-owned output directory. The write location is fixed, is not disclosed by the usage documentation, and is not checked against an allowed base directory. This breaks the expected least-privilege filesystem boundary of the Skill. The logged record can contain publication titles, tags, local cover paths, public URLs, timestamps, and publication status. The code appends rather than overwrites, limiting direct destructive impact. However, adjacent projects using the same parent directory can collide with or read the same file subject to operating-system permissions. Symbolic-link behavior may also redirect the write if an attacker can control the destination path or its parent directory. ### Attack Path 1. The workflow successfully reaches the publication logging stage. 2. `full_auto.py` constructs a record containing publication metadata. 3. `log_published()` resolves `../../published.jsonl` outside the project root. 4. The process appends the record to the shared parent location. 5. Another tenant or project with access to that location may read the metadata or cause a path collision. 6. If an attacker can pre-position a symbolic link at the destina ...[truncated 567 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description promises a full-chain Xiaohongshu automation system covering multiple stages from trend discovery through publishing. The supplied code chunk implements only one narrow component: retrieving hot topics via an external API and returning normalized topic metadata, with a hardcoded fallback list if the request fails. There is no evidence of content analysis, generation, image creation, account interaction, posting, scheduling, or workflow orchestration. Therefore, the description materially overstates the functionality of this code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The description promises an end-to-end Xiaohongshu content automation system covering multiple stages from trend acquisition through publishing. However, this code chunk only implements one limited step: matching existing hot-topic titles to user niches via substring/word matching and sorting by a combined relevance/hotness score. It does not fetch trends itself, generate text, create images, publish content, or interact with Xiaohongshu. This is a material description-behavior mismatch because the actual behavior is much narrower than the declared primary purpose.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: xiaohongshu-full-auto
description: 🚀 小红书全链路自动化自媒体工作流，从热点抓取 → 选题分析 → 文案生成 → 封面图生成 → 自动发布，一条龙全自动搞定小红书内容创作。适合自媒体博主、副业玩家、内容工作室批量生产小红书内容。触发关键词："全自动小红书", "小红书创作", "小红书自动发布", "小红书热榜", "批量做小红书", "xiaohongshu auto"。
---

# xiaohongshu-full-auto — 小红书全链路自动化自媒体工作流

> **核心价值**：让 AI 帮你完成从小红书热点发现到内容发布的全�

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill advertises capabilities that imply network access, local file reads/writes, and automated publishing, but it does not declare any explicit tool scope or permissions boundaries. In an agent environment, this weakens least-privilege controls and can cause the skill to run with broader access than users expect, increasing the chance of unintended network calls or filesystem changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill promotes fully automatic publishing and local data logging without clear warnings about account impact, content review, or filesystem changes. In this context, automation against a social-media account can cause accidental posting, policy violations, reputation damage, or unintended storage of sensitive content and account metadata.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill requests sensitive account credentials, including a Xiaohongshu cookie, without warning users about secure handling, storage, rotation, or the risks of credential theft. Session cookies can grant direct account access, so careless collection or reuse could enable account takeover, unauthorized posting, or data exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The quick-start workflow enables end-to-end automatic generation and posting without requiring human review before publication. Because the skill context is mass content creation and account automation, this raises the risk of publishing inaccurate, policy-violating, spammy, or reputationally harmful content directly to a live account.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The configuration explicitly documents a full-auto mode that performs end-to-end content generation and publishing without confirmation. In a skill designed for automated social-media posting, this increases the risk of unintended, policy-violating, or harmful publication because there is no mandatory human review or safeguard before external action is taken.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The workflow can publish content automatically whenever config['publish']['enable'] is true and the mode is not semi-auto, with no explicit per-post confirmation or safety gate. In the context of a mass-content automation skill for Xiaohongshu, this increases the risk of unintended posting, account misuse, policy violations, or publication of generated content that was never reviewed by a human.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The file’s natural-language description and docstrings are entirely in Chinese, with no indication that the skill is intentionally region-specific or that users may opt into another language. Under the policy, forcing a specific language without user opt-in is a locale/language policy concern.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

The script sends a network request to a third-party domain (api.fakey.top) to retrieve content that is later trusted as hot-topic input. This creates a supply-chain/data-integrity risk: the external service could be unavailable, manipulated, or return malicious/poisoned content that propagates into downstream automated content-generation and publishing steps in this full-auto workflow.

Content

Scanner excerpt · scripts/get_hot_topics.py (reported line 35)May include surrounding context.

python

try:
        # 这里使用公开可访问的热榜接口
        # 实际生产环境可以使用小红书 MCP 或者公开爬虫
        response = requests.get("https://api.fakey.top/xiaohongshu/hot", headers=headers, timeout=10)
        if response.status_code == 200:
            data = response.json()
            topics = []

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The natural-language descriptions and examples throughout the file assume a Chinese-language Xiaohongshu content workflow, including Chinese niches and platform-specific content conventions, without offering a language or locale choice. This can violate language/locale policy when a skill is expected to support user preference rather than enforce a single locale by default.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Natural-language strings in the module docstring, CLI description, prompts, and status output are presented only in Chinese. This enforces a specific language/locale without offering user choice or documenting that the skill is intentionally restricted to a Chinese-language audience.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The module docstring and function docstrings are written only in Chinese (e.g. '发布日志记录', '记录一条发布记录', '获取发布历史'). This imposes a specific language choice in the skill's natural-language content without any visible opt-in or justification, which matches the locale/language policy violation criterion.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This Python file contains its natural-language descriptions entirely in Chinese, including the module docstring and function docstrings/comments. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation when no alternative or justification is provided.

Content

No source excerpt is available for this finding.