Security audit
Security checks for vulnerabilities and agentic risk
This skill has a coherent, disclosed purpose: it sends user-provided Xiaohongshu links to LinkDigest to turn notes into text, OCR, summaries, and related metadata.
Install only if you are comfortable sending the note link or share text, including any embedded access token parameters, to linkdigest.dev. Do not submit private or sensitive links, and prefer the included Python script over the optional unpinned npx MCP bridge unless you pin and trust that dependency.
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
实测同一条图文笔记（公开结果页：https://linkdigest.dev/d/5d0e7837ec2742ea4ae07806d979f0ce ）：
- 直接 curl 网页，去掉脚本和样式后只剩 860 个可见字符；
- yt-dlp 报 `No video formats found`（它只认视频笔记）；
- LinkDigest 返回的 Markdown 是 35,059 个字符，约为前者的 41 倍。
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
实测同一条图文笔记(公开结果页:https://linkdigest.dev/d/5d0e7837ec2742ea4ae07806d979f0ce ):
- 直接 curl 网页,去掉脚本和样式后只剩 860 个可见字符;
- yt-dlp 报 `No video formats found`(它只认视频笔记);
- LinkDigest 返回的 Markdown 是 35,059 个字符,约为前者的 41 倍。
The skill invokes shell commands, reads environment variables, and performs outbound network requests, but it does not declare any explicit tool scope or permissions boundary. That makes the effective privilege set broader and less auditable, increasing the chance that a host agent will grant capabilities the user did not expect.
The skill sends user-supplied Xiaohongshu links and an authorization token to an external service (linkdigest.dev) for processing. Although this is core to the feature, it is still a real data-transmission risk because the service receives potentially sensitive URLs, embedded tokens like xsec_token, and usage metadata outside the local environment.
提交：
curl -sS -X POST https://linkdigest.dev/api/v1/digest \
-H "Authorization: Bearer $LINKDIGEST_API_KEY" \
-H "Content-Type: application/json" \
-d '{"url": "https://www.xiaohongshu.com/explore/<笔记ID>?xsec_token=<...>", "format": "json"}'
The documentation instructs users to run npx mcp-remote without pinning a specific version or integrity hash. This creates a supply-chain risk: a future malicious or compromised package version could execute arbitrary code in the user's environment when the MCP bridge is installed or run.
No suspicious patterns detected.