Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed LinkDigest client that sends user-provided Xiaohongshu links to an external OCR/digest API, with no hidden local persistence or account access found.
Before installing, be comfortable sending each submitted link or share text to linkdigest.dev with your LinkDigest API key. Do not submit private or sensitive links, because text results are cached by link and may be reused for the same public link. Avoid the optional unpinned npx MCP command unless you trust that npm package path, and use max-credit limits when cost matters.
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
实测同一条图文笔记（公开结果页：https://linkdigest.dev/d/5d0e7837ec2742ea4ae07806d979f0ce ）：
- 直接 curl 网页，去掉脚本和样式后只剩 860 个可见字符；
- yt-dlp 报 `No video formats found`（它只认视频笔记）；
- LinkDigest 返回的 Markdown 是 35,059 个字符，约为前者的 41 倍。
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
实测同一条图文笔记(公开结果页:https://linkdigest.dev/d/5d0e7837ec2742ea4ae07806d979f0ce ):
- 直接 curl 网页,去掉脚本和样式后只剩 860 个可见字符;
- yt-dlp 报 `No video formats found`(它只认视频笔记);
- LinkDigest 返回的 Markdown 是 35,059 个字符,约为前者的 41 倍。
Without declared permissions the skill's intent is opaque and cannot be validated.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
提交：
curl -sS -X POST https://linkdigest.dev/api/v1/digest \
-H "Authorization: Bearer $LINKDIGEST_API_KEY" \
-H "Content-Type: application/json" \
-d '{"url": "https://www.xiaohongshu.com/explore/<笔记ID>?xsec_token=<...>", "format": "json"}'
The skill instructs users to run npx mcp-remote without pinning a version or integrity. That can cause execution of a changed or compromised package from the npm registry, creating a supply-chain risk on the local machine.
The manifest describes a narrowly scoped skill for extracting Xiaohongshu 图文笔记 content and OCR text from images. However, the CLI advertises and accepts broader platform usage such as 抖音, TikTok, YouTube, X, and公众号文章, plus video-oriented options like transcript depth and partial long-video handling, which materially exceeds the declared skill purpose.
The manifest presents this skill as an extractor for note text, OCR text, image descriptions, key points, likes/favorites, and hashtags. The code adds separate paid capabilities for translation and marketing-style breakdown analysis, which are not described as part of the skill’s intended behavior.
No suspicious patterns detected.