Security audit
Security checks for vulnerabilities and agentic risk
This uploader needs review because it can close existing editing tabs, change drafts during dry runs, and upload videos to an incorrectly selected page.
Before running, require fixes for automatic tab closure, exact site/account/draft selection, and dry-run checks before any changes. Use a dedicated browser profile, preserve existing drafts, configure the hardcoded paths, and review locally retained screenshots and inventories. Keep publishing and deletion explicitly user-approved.
scripts/xhs-draft-ep.jsSubstring-based browser target selection can upload local videos to an attacker-controlled page
The attacker can obtain the selected local video without authorization to receive it. Subsequent editor checks occur after file access is granted and cannot prevent the disclosure.
Referenced artifact was not completely inspected
1. `xhs-draft-ep.js`（上传 + 标题 + 正文 + 话题 + 原创 + 合集，`NO_CHAPTER=1` 可跳过章节）
The skill declares no tool scope despite directing local script execution and CDP access to a persistent, authenticated Chrome session. These capabilities permit public posting, irreversible draft deletion, and access to browser targets beyond the intended workflow, making unconstrained execution consequential. The documented dry-run and submission checks reduce accidental actions but do not enforce tool or account boundaries; there is no evidence here of malicious intent or exfiltration.
If no blank upload tab is found, the script closes every tab whose URL contains creator.xiaohongshu.com, including unrelated editing sessions that may contain unsaved work. Because this skill controls the user's existing authenticated Chrome rather than an isolated browser, this cleanup can cause data loss outside the requested draft operation; the comment indicates intentional housekeeping rather than malicious intent.
DRY=1 is checked only after the script has closed duplicate editor tabs, dismissed or removed dialogs, clicked original-content declaration controls, and potentially changed the selected collection. These actions contradict the scan-only message and can discard unsaved work or alter account content and declarations; attaching to an already authenticated browser makes those side effects consequential, although this branch does prevent the final save-button click.
The script writes a screenshot of the creator page to the SHOT directory, potentially retaining private draft content. No confirmation, log message, or explanatory comment discloses this capture, which is separate from the stated purpose of uploading a draft.
The screenshot persists potentially private draft content under the configured SHOT directory. No prompt, log, or explanatory comment discloses this capture, and saving screenshots is not part of the script's stated purpose of repairing draft metadata.