T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/cdp_xhs_publish.py:436- Finding
Live Publishing Is Enabled by Default Despite the Documented Opt-In Safety Contract
- Content
View full analysis
- Remediation
View remediation
Security audit
ZeeLin 小红书自动发布
Security checks for vulnerabilities and agentic risk
Overview
This skill is meant to generate and publish Xiaohongshu posts, but it can automatically post through a logged-in browser without a clear final approval step.
Install only if you intentionally want a skill that can operate a logged-in Xiaohongshu creator account. Use an isolated browser profile, review generated titles/body/tags manually, set draft-only controls where available, and do not rely on the documented XHS_AUTO_PUBLISH safety claim unless the scripts are fixed.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/cdp_xhs_publish_v5.py:439- Finding
The Version 5 Publisher Also Performs Live Publishing Without the Documented Positive Opt-In
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/cdp_xhs_publish_v2.py:15- Finding
Legacy CDP Publishers Select Browser Tabs Using an Untrusted URL Substring
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (35)
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The documentation describes a broad trend-scraping and planning workflow, but the actual code path appears to be a narrow execution wrapper for publishing via CDP, with key claimed capabilities not evidenced. This mismatch is security-relevant because it obscures the true privileged action the skill performs and frustrates accurate review of operational risk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The documentation describes a broad trend-scraping and planning workflow, but the actual code path appears to be a narrow execution wrapper for publishing via CDP, with key claimed capabilities not evidenced. This mismatch is security-relevant because it obscures the true privileged action the skill performs and frustrates accurate review of operational risk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The documentation describes a broad trend-scraping and planning workflow, but the actual code path appears to be a narrow execution wrapper for publishing via CDP, with key claimed capabilities not evidenced. This mismatch is security-relevant because it obscures the true privileged action the skill performs and frustrates accurate review of operational risk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The documentation describes a broad trend-scraping and planning workflow, but the actual code path appears to be a narrow execution wrapper for publishing via CDP, with key claimed capabilities not evidenced. This mismatch is security-relevant because it obscures the true privileged action the skill performs and frustrates accurate review of operational risk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The documentation describes a broad trend-scraping and planning workflow, but the actual code path appears to be a narrow execution wrapper for publishing via CDP, with key claimed capabilities not evidenced. This mismatch is security-relevant because it obscures the true privileged action the skill performs and frustrates accurate review of operational risk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The documentation describes a broad trend-scraping and planning workflow, but the actual code path appears to be a narrow execution wrapper for publishing via CDP, with key claimed capabilities not evidenced. This mismatch is security-relevant because it obscures the true privileged action the skill performs and frustrates accurate review of operational risk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The documentation describes a broad trend-scraping and planning workflow, but the actual code path appears to be a narrow execution wrapper for publishing via CDP, with key claimed capabilities not evidenced. This mismatch is security-relevant because it obscures the true privileged action the skill performs and frustrates accurate review of operational risk.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The trigger description is extremely broad and overlaps with ordinary requests for writing, topic ideas, hooks, and content planning. Because the same skill also contains live publishing behavior, this broad activation surface materially increases the risk of unexpected invocation of a high-impact automation pathway.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill describes automatic publishing/output generation without warning the user that actions may affect a live third-party account or produce externally visible posts. In this context, absence of disclosure is dangerous because publication is irreversible in practice and can cause reputational, compliance, or business harm if done unexpectedly.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The publishing SOP culminates in clicking the final red 'publish' button, yet there is no explicit user confirmation, safety pause, or caution about the external effect. This is especially dangerous because it automates a sensitive state-changing action on a logged-in account and could post unintended, unreviewed, or policy-violating content.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `scripts/auto_topic_post_xiaohongshu.sh`：主题到发布一体化。
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `scripts/post_xiaohongshu.sh`：仅执行发布流程（接收标题与正文）。
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The trigger conditions are extremely broad and include generic terms like '文案', '内容运营', '选题', and even common requests such as '帮我写个短视频文案', which can cause the skill to activate for many ordinary user prompts outside its intended scope. Overbroad routing can hijack unrelated conversations, override more appropriate tools or skills, and increase the chance that web-search-driven automation runs without clear user intent or sufficient context validation.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The module docstring explicitly says publishing will not occur unless XHS_AUTO_PUBLISH=1, but the actual logic does the opposite: it publishes by default unless XHS_NO_PUBLISH is set. In an automation skill that controls a live creator account, this mismatch is dangerous because callers may trust the documented safety guard and unintentionally trigger real posts, causing unauthorized publication, reputational harm, or disclosure of draft/sensitive content.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The script connects to an existing Chrome DevTools endpoint on localhost and attaches to a live Xiaohongshu tab, giving it powerful control over an already authenticated browser session. That allows the skill to act as the logged-in user without normal application permission checks, creating a high-risk path for account misuse, unintended actions, or abuse of any accessible browser context.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The docstring states the script will not click the publish button unless XHS_AUTO_PUBLISH=1, but the implementation does the opposite: it publishes by default unless XHS_NO_PUBLISH is set. This creates a dangerous mismatch between documented and actual behavior, making accidental live posting likely for operators or downstream agents that rely on the stated safety guard.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 87% confidence
- Finding
The skill advertises executable behavior that depends on network and environment-backed capabilities, but it does not declare a restrictive tool scope such as allowed-tools or permissions. This creates an authorization and review gap: the runtime may grant broader access than users or reviewers expect, increasing the chance of unintended network access or local-environment interaction.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documentation shifts from content planning into a concrete live website publishing workflow, but the manifest framing does not clearly surface that escalation. In context, this increases danger because a user selecting a content-ops skill may unknowingly expose an authenticated browser session to automated posting behavior.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The shell-script entrypoints enable direct website posting, which is broader and more sensitive than the stated content ideation use case. Exposing executable publication scripts without a clearly declared permission boundary increases the chance of misuse, accidental execution, or under-reviewed account-impacting actions.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The file is written as a Chinese-only operating skill and all invocation examples, output structures, and writing guidance assume Chinese content generation by default. There is no indication that the user can choose another language or locale, which may violate a language-choice policy when the skill is used in broader contexts.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
This markdown file is written as a core reference for content generation entirely in Chinese and does not indicate that users may choose another language or locale. Under the policy rule for natural-language violations, a skill that implicitly enforces a specific language without opt-in can be noncompliant unless the locale restriction is clearly documented and justified.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill metadata frames this capability as content ideation and copy generation, but the script goes further and performs a live publish action to Xiaohongshu. That mismatch is security-relevant because users or calling agents may invoke the skill expecting draft assistance, while the script can cause an external side effect by posting content without an explicit, separately authorized publish step.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script automatically publishes generated content immediately after draft creation, with no user confirmation, review gate, or warning before the external action. In the context of a social-media automation skill, this is more dangerous because model-generated content may be inaccurate, policy-violating, or manipulated by prompt/input content, leading to unwanted public posts, reputational harm, or account penalties.
- Content
Internal Network Request
Medium
- Category
- Server-Side Request Forgery
- Confidence
- 70% confidence
- Finding
Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.
- Content
python def list_tabs(p: int): with urllib.request.urlopen(f"http://127.0.0.1:{p}/json", timeout=8) as r: return json.loads(r.read())