龙虾内容工厂

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:41 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches a Xiaohongshu content workflow, but it recommends persistent scheduled browser automation and executes an external mutable script outside the reviewed package.

Review before installing. This skill can write generated media files, run local programs, control a logged-in Chrome/Xiaohongshu session, and create a persistent cron task. Avoid the cron setup unless you add lifecycle controls, change generate-today.py to call the bundled make_card.py, pin dependencies, and replace innerHTML body filling with plain-text insertion.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (4)

T06 · System Persistence

Error

• Location: SKILL.md:93

Finding

Persistent Scheduled Publishing Task Without Lifecycle Controls

Content

View full analysis

'<标题>' '<正文>'" ``` ### Technical Analysis The installation instructions register a recurring OpenClaw cron task that survives the initial Skill run. The task uses a natural-language message directing an agent to read a mutable `manifest.json` file and invoke the browser publishing script. The scheduled task has no expiration, execution-count limit, removal procedure, manifest integrity validation, or requirement for per-run approval. Because both the manifest and publisher script may change after the task is registered, future executions can behave differently from the workflow initially reviewed by the user. Although scheduling is an advertised feature, the absence of lifecycle and integrity controls creates a persistence risk. ### Attack Path 1. The user follows the documented setup procedure and registers the cron task. 2. The task remains active across subsequent sessions. 3. An attacker or another local process with write access modifies `manifest.json`, the referenced publishing script, or its arguments. 4. At the scheduled time, OpenClaw interprets the natural-language task and executes the publisher using the modified inputs. 5. The operation reaches an existing authenticated browser session through Chrome DevTools Protocol. ### Impact Assessment Successful exploitation can cause repeated invocation of the publishing workflow with the user's local account privileges. It can also operate against the user's authenticated Xiaohongshu browser session. The documented script does not automatically click the final publication button, which limits the immediate effect. However, the persistent task can re ...[truncated 192 chars]

Remediation

View remediation

T07 · Tool Hijacking and Spoofing

Error

• Location: scripts/generate-today.py:9

Finding

Execution of an External Mutable Script Instead of the Bundled Generator

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:24

Finding

Unpinned and Globally Installed Third-Party Dependencies

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/publish-xhs.js:68

Finding

Unsanitized HTML Injection Into an Authenticated Browser Page

Content

View full analysis

{ const el = document.querySelector(selector); if (el && el.contentEditable === 'true') { el.innerHTML = value.split('\n').map(l => `

${l || '
'}

`).join(''); el.dispatchEvent(new Event('input', { bubbles: true })); } }, { selector: '[contenteditable="true"]', value: content }); console.log('📝 正文已填写'); } ``` ### Technical Analysis The `content` command-line argument is interpolated into HTML fragments and assigned directly to `innerHTML`. No HTML escaping or sanitization is performed. Consequently, strings containing markup are interpreted as DOM elements rather than plain post text. The injection occurs inside an authenticated Xiaohongshu creator page reached through the user's existing Chrome debugging session. Browser protections may prevent some script forms from executing, and the exact behavior of event-handler attributes depends on the page's Content Security Policy and DOM handling. Nevertheless, arbitrary markup can be introduced into the page, making this an unsafe DOM injection sink. The workflow only needs to enter plain text, so parsing user or generated content as HTML is unnecessary. ### Attack Path 1. Attacker-controlled or untrusted generated text is supplied as the `content` command-line argument. 2. The publisher connects to the user's existing authenticated Chrome session. 3. `page.evaluate()` splits the text into lines and concatenates each line into a `

` element without escaping it. 4. The combined string is assigned to the editor's `innerHTML`. 5. The browser parses attacker-supplied markup in the authenticated creator page. 6. Depending on the site's content security controls and editor behavior, the injected markup can modify the form DOM ...[truncated 579 chars]

Remediation

View remediation

{ const el = document.querySelector(selector); if (!el || el.contentEditable !== 'true') return; el.replaceChildren(); for (const line of value.split('\n')) { const paragraph = document.createElement('p'); if (line) { paragraph.textContent = line; } else { paragraph.appendChild(document.createElement('br')); } el.appendChild(paragraph); } el.dispatchEvent(new InputEvent('input', { bubbles: true, inputType: 'insertText', data: null })); }, { selector: '[contenteditable="true"]', value: content }); ``` Additionally: - Treat manifest and command-line content as untrusted input. - Enforce maximum content length and expected character constraints. - Use a precise editor selector rather than the first generic content-editable element. - Add tests containing HTML metacharacters and event-bearing markup to verify that they remain literal text. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The code does match part of the description: it generates Xiaohongshu-style infographic images and videos in batch. However, the description materially overstates the behavior by claiming timed automatic publishing. In the provided code, there is no API call, browser automation, uploader invocation, scheduler registration, or any posting logic. The schedule values are only embedded in static post definitions and saved into manifest.json as metadata. The script writes files to queue/upload directories and invokes external programs (make_card.py and ffmpeg), but it stops after preparing assets and a manifest marked ready. Therefore the declared purpose is not fully accurate, with the main mismatch being the absent auto-publish/scheduling capability.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The code only implements image card generation using Pillow. It accepts title/items inputs, supports presets, and can batch-generate multiple PNG cards from a JSON file. There is no code for video creation, no scheduler/cron/timer behavior, no network/API calls, and no publishing to Xiaohongshu or any other platform. The declared description therefore materially overstates the skill's capabilities compared with the supplied code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

The declared description promises a broader automated system: batch creation of Xiaohongshu infographics and videos plus scheduled automatic posting. The supplied code only automates opening the Xiaohongshu publish page, selecting a video file, and filling title/body fields for one post. It explicitly stops short of clicking the publish button, stating manual confirmation is required. There is also no evidence of content generation, infographic generation, bulk processing, or scheduling logic. Therefore the description materially overstates and misrepresents the actual behavior.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill advertises operational steps that require filesystem access, dependency installation, and shell execution, but it does not declare any explicit tool scope or permissions. This creates a trust and review gap: an agent or user may approve the skill without understanding that it can write files, invoke external programs, and interact with local tooling.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 80% confidence

Finding

The installation instructions use an unpinned Playwright package via npm/npx, which makes the skill depend on whatever version is current at install time. That increases supply-chain and reproducibility risk, because a compromised or breaking upstream release could change behavior or introduce malicious code into the local environment.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown file presents all skill content exclusively in Chinese, including headings and template instructions. Under the policy for natural-language violations, forcing a specific language without user opt-in or documented justification is a reportable locale-policy issue.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/generate-today.py (reported line 73)May include surrounding context.

python

if items:
            cmd += ["--items"] + items
        
        r = subprocess.run(cmd, capture_output=True, text=True)
        if r.returncode == 0:
            pngs.append(fpath)
            print(f"  ✅ {fname}")

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/generate-today.py (reported line 101)May include surrounding context.

python

if items:
            cmd += ["--items"] + items
        
        r = subprocess.run(cmd, capture_output=True, text=True)
        if r.returncode == 0:
            pngs.append(fpath)
            print(f"  ✅ {fname}")

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This code file contains user-facing natural-language text exclusively in Chinese in the module docstring and dependency error message. Under the language/locale policy, forcing a specific language without user opt-in can be a policy violation when no alternative language option or justification is provided.

Content

No source excerpt is available for this finding.