xiaohongshu-auto-poster

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:16 AM UTC
• Version: 1.0.0

Overview

This skill is clearly meant to automate Xiaohongshu posting, but it asks users to run and optionally persist an unverified third-party local service that can act on an authenticated social account.

Review this carefully before installing. Only use it if you trust the external Xiaohongshu MCP binary and understand that it can publish to your account. Prefer running the service manually only when needed, verify the binary from the upstream project if possible, avoid enabling LaunchAgent auto-start, and require yourself to preview generated posts before publishing.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T06 · System Persistence

Error

• Location: references/setup.md:48

Finding

Persistent Execution of a Third-Party MCP Binary Through a macOS LaunchAgent

Content

View full analysis

~/Library/LaunchAgents/com.xiaohongshu.mcp.plist << 'EOF' Label com.xiaohongshu.mcp ProgramArguments /Users/YOUR_USERNAME/xiaohongshu-mcp-darwin-arm64 RunAtLoad WorkingDirectory /Users/YOUR_USERNAME/xiaohongshu-mcp EOF launchctl load ~/Library/LaunchAgents/com.xiaohongshu.mcp.plist ``` ### Technical Analysis The setup instructions create a per-user macOS LaunchAgent and immediately register it with `launchctl`. The `RunAtLoad` property causes the specified MCP executable to run automatically when the user logs in, allowing execution to continue across sessions. Cross-session startup is not required for the Skill's core functions of generating content and publishing a post. The MCP service can instead be started explicitly when a user intends to publish. The persistence mechanism therefore exceeds the minimum execution lifetime necessary for the declared functionality. The persisted executable is also a separately downloaded third-party binary. The LaunchAgent contains no integrity check, version pin, sandbox profile, resource restriction, or other control that would prevent a replaced or compromised executable at the configured path from being launched automatically. ### Attack Path 1. A user follows the setup guide and downloads the externally hosted MCP executable. 2. The user creates the LaunchAgent property list under `~/Library/LaunchAgents`. 3. The user loads the property list with `launchc ...[truncated 944 chars]

Remediation

View remediation

T03 · Remote Payload Retrieval and Execution

Error

• Location: references/setup.md:11

Finding

Retrieval and Execution of an Unpinned, Unverified Third-Party Binary

Content

View full analysis

mcp.log 2>&1 & ``` ### Technical Analysis The installation guide directs users to retrieve a native executable from an external GitHub Releases page, grant it executable permission, and run it locally. The instructions do not pin a release version or exact artifact URL and do not provide a checksum, cryptographic signature, trusted publisher identity, or reproducible-build verification procedure. Consequently, the effective executable payload can change independently of this audited Skill package. The external binary is not included in the project, so its implementation and handling of Xiaohongshu authentication state cannot be assessed by this static audit. The risk is further amplified by the separate LaunchAgent instructions, which can arrange for this unverified executable to run automatically across login sessions. ### Attack Path 1. An attacker compromises the external repository, its maintainer account, release pipeline, or downloadable release artifact. 2. Alternatively, a user is induced to select an incorrect or substituted artifact because no exact version, digest, or signature is specified. 3. The user downloads the attacker-controlled native executable. 4. Following the guide, the user applies executable permissions with `chmod +x`. 5. The user launches the binary with `nohup`, causing arbitrary native code to execute with th ...[truncated 931 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (25)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file explicitly says the system will generate content and publish it automatically, but provides no warning, review gate, or confirmation step. Because this skill interfaces with a social posting workflow, that behavior can lead to accidental publication, reputational damage, or posting of incorrect or policy-violating content without the user’s final approval.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README explicitly instructs users to authorize login and automatically publish posts, but it does not warn about the account, privacy, and platform-policy consequences of letting an AI trigger actions on a social media account. In this skill context, the omission is more dangerous because the workflow is designed to perform real authenticated actions on behalf of the user, increasing the risk of unintended posting, account misuse, or policy violations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill promises automatic publication to a user's Xiaohongshu account without clearly warning that this is an account-impacting action or requiring an explicit confirmation step before posting. In an agent context, this creates a real risk of unintended live posts, reputational harm, spammy behavior, or platform policy violations if the user issues an ambiguous or manipulated prompt.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 24)May include surrounding context.

第一步：检查 MCP 服务状态

bash

curl -s -X POST http://localhost:18060/mcp \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","method":"initialize","params":{},"id":1}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

第一步：检查 MCP 服务状态

bash

curl -s -X POST http://localhost:18060/mcp \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","method":"initialize","params":{},"id":1}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/setup.md (reported line 31)May include surrounding context.

第一步：检查 MCP 服务状态

bash

curl -s -X POST http://localhost:18060/mcp \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","method":"initialize","params":{},"id":1}'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The quick-start example encourages the user to issue a natural-language command that immediately triggers live posting, but it does not clearly warn that the example will publish to the real account. This is dangerous because users may treat it as a harmless demo, causing accidental posts and downstream account or reputation impact.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest description says the skill works when the user '说一句话就能自动发小红书' ('say one sentence and it can automatically post to Xiaohongshu'). This invocation description is highly ambiguous and broad, with no specific trigger phrases, scope limits, or exclusion conditions, increasing the risk of unintended activation from ordinary conversation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 72% confidence

Finding

The natural-language description is presented only in Chinese and implies operation in that language without any opt-in or documented locale constraint. This can violate language or locale policy when a skill effectively assumes a specific language without offering a user choice or explaining that it is intended only for a Chinese-language context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

All instructions and examples are written as if the skill operates only in Chinese, and there is no indication that users can choose another language. This can violate language or locale policy when a skill forces a specific language without user opt-in or justification.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The usage section uses broad natural-language activation phrases like “发小红书” and states the system will automatically choose a template and publish, which can cause the skill to trigger from ordinary user requests without clearly scoped invocation boundaries. In an automation skill that posts to an external platform, ambiguous activation increases the risk of unintended content generation and publication.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The guide instructs users to download and execute an externally hosted binary, then keep it running in the background, without any integrity verification, publisher trust guidance, sandboxing advice, or warning about the privileges and risks of running an unreviewed executable. In the context of an automation skill that later authenticates to a user account, this increases the chance that users grant persistent local execution to software that could access account sessions or system data.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The guide directs users to run the MCP binary via nohup in the background, creating a persistent long-lived local service without explaining the security implications, monitoring, or shutdown procedures. In a skill that manages authenticated posting, persistent background execution increases the window in which stolen sessions, exposed local endpoints, or abused automation can be used.

Content

Scanner excerpt · references/setup.md (reported line 28)May include surrounding context.

bash

# 后台运行
nohup ./xiaohongshu-mcp-darwin-arm64 > mcp.log 2>&1 &

# 验证服务运行
curl -s -X POST http://localhost:18060/mcp \

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The QR-code login flow asks the user to authorize their Xiaohongshu account to the local MCP service but does not disclose that this may grant the service access to account session state, posting capability, or stored credentials/tokens. Because the purpose of the skill is automated posting, the account-authorization step is especially sensitive and should be treated as granting high-value access.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 92% confidence

Finding

The auto-start section introduces a LaunchAgent plist for persistent execution at login, which establishes session persistence for the MCP service. For a local automation component that can hold authenticated account access, persistence materially increases risk if the binary is compromised or misconfigured.

Content

Scanner excerpt · references/setup.md (reported line 51)May include surrounding context.

设置开机自启动（macOS）

bash

# 创建 plist 文件
cat > ~/Library/LaunchAgents/com.xiaohongshu.mcp.plist << 'EOF'
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "...">

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The plist creation instructions are part of establishing persistent execution, but the guide omits security caveats about auto-starting a third-party binary with access to an authenticated social-media workflow. This expands attack surface by making the service consistently available after login.

Content

Scanner excerpt · references/setup.md (reported line 52)May include surrounding context.

bash

# 创建 plist 文件
cat > ~/Library/LaunchAgents/com.xiaohongshu.mcp.plist << 'EOF'
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "...">
<plist version="1.0">

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

Although this finding duplicates the same persistence block, it still reflects the same issue: the setup normalizes persistent local execution of a third-party MCP service tied to account automation without adequate warning. The danger comes from increasing the longevity and reliability of access for any compromised or malicious binary.

Content

Scanner excerpt · references/setup.md (reported line 54)May include surrounding context.

md

# 创建 plist 文件
cat > ~/Library/LaunchAgents/com.xiaohongshu.mcp.plist << 'EOF'
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "...">
<plist version="1.0">
<dict>
    <key>Label</key>

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

Although this finding duplicates the same persistence block, it still reflects the same issue: the setup normalizes persistent local execution of a third-party MCP service tied to account automation without adequate warning. The danger comes from increasing the longevity and reliability of access for any compromised or malicious binary.

Content

Scanner excerpt · references/setup.md (reported line 54)May include surrounding context.

md

# 创建 plist 文件
cat > ~/Library/LaunchAgents/com.xiaohongshu.mcp.plist << 'EOF'
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "...">
<plist version="1.0">
<dict>
    <key>Label</key>

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

The named LaunchAgent entry formalizes persistence for the MCP service under the user's session. In a tool designed to automate social-media posting after user login, persistent background availability increases the risk of unauthorized posting or misuse if the binary, local host, or stored session material is compromised.

Content

Scanner excerpt · references/setup.md (reported line 55)May include surrounding context.

md

cat > ~/Library/LaunchAgents/com.xiaohongshu.mcp.plist << 'EOF'
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "...">
<plist version="1.0">
<dict>
    <key>Label</key>
    <string>com.xiaohongshu.mcp</string>

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The persistence configuration remains active through the completed plist definition, but the documentation still does not address review, containment, or removal of the auto-started service. Persistence is more dangerous here because the skill's purpose includes authenticated automated posting, so long-lived access has real account impact.

Content

Scanner excerpt · references/setup.md (reported line 68)May include surrounding context.

md

<key>WorkingDirectory</key>
    <string>/Users/YOUR_USERNAME/xiaohongshu-mcp</string>
</dict>
</plist>
EOF

launchctl load ~/Library/LaunchAgents/com.xiaohongshu.mcp.plist

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

This duplicate hit at the same line refers to the same LaunchAgent activation path and therefore the same persistence risk. The issue is not the plist syntax itself, but the guidance to enable durable background execution of a third-party account-automation service without sufficient safeguards or warnings.

Content

Scanner excerpt · references/setup.md (reported line 71)May include surrounding context.

EOF

launchctl load ~/Library/LaunchAgents/com.xiaohongshu.mcp.plist

text

把 `YOUR_USERNAME` 替换成你的用户名。

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

This duplicate hit at the same line refers to the same LaunchAgent activation path and therefore the same persistence risk. The issue is not the plist syntax itself, but the guidance to enable durable background execution of a third-party account-automation service without sufficient safeguards or warnings.

Content

Scanner excerpt · references/setup.md (reported line 71)May include surrounding context.

EOF

launchctl load ~/Library/LaunchAgents/com.xiaohongshu.mcp.plist

text

把 `YOUR_USERNAME` 替换成你的用户名。

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The invocation examples and user-facing instructions require Chinese trigger phrases such as '发小红书' and '小红书重新登录', but the README does not offer an alternative language option or explain that Chinese is a required locale constraint. That is a natural-language policy concern because it imposes a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

In the command reference, 发小红书视频：[主题] is documented as generating and publishing a video post. However, the later 不适用 section says the skill is not suitable for users who need to publish video content because the templates are mainly for image-text posts, which directly conflicts with the earlier capability claim.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The instructions specify exact Chinese commands for interacting with the skill, and the document is entirely presented in Chinese without indicating that language support is optional or limited by design. This can violate a language/locale policy when a specific language is imposed without user opt-in or explicit justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.