Xiaohongshu Mcp Skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:19 AM UTC
• Version: 1.0.0

Overview

The skill is aimed at Xiaohongshu search, but it asks users to run unverified external binaries that handle login/session data and exposes live account actions without enough safeguards.

Review this carefully before installing. Only use it if you trust the external MCP binary source, can verify the downloaded files independently, and are comfortable with a local background service holding Xiaohongshu cookies and potentially liking, favoriting, or commenting from your account. Avoid running it on shared machines or with elevated privileges, and remove cookies or stop the service when finished.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: README.md:20

Finding

Unverified External Executables Are Downloaded and Run with User Privileges

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 20-35
Vulnerability Type: Unverified third-party binary dependency
Risk Level: High

Vulnerable Code

text

- macOS ARM64: `xiaohongshu-mcp-darwin-arm64.tar.gz`
- macOS x64: `xiaohongshu-mcp-darwin-x64.tar.gz`
- Linux: `xiaohongshu-mcp-linux-amd64.tar.gz`

https://github.com/example/xiaohongshu-mcp

bash

cd ~/xiaohongshu-mcp/bin
./xiaohongshu-login-darwin-arm64
nohup ./xiaohongshu-mcp-darwin-arm64 > ../mcp.log 2>&1 &

Technical Analysis

The installation instructions direct users to download and execute precompiled login and MCP binaries from an external GitHub repository. The documented repository uses the placeholder account example, does not pin an immutable release or commit, and provides no checksum or cryptographic signature verification.

The downloaded components are security-sensitive because they perform account login, handle session cookies, and expose MCP operations. Their effective behavior cannot be established by auditing this project because their source and binaries are not included. If the repository, release artifacts, DNS path, or maintainer account is compromised, an attacker can replace the binaries after this Skill has already been reviewed.

Running the service with nohup also leaves the unverified component operating in the background beyond the initiating shell session, increasing the duration during which a compromised binary could act.

Attack Path

1. An attacker gains control of the referenced repository or publishes artifacts at the placeholder location.
2. The attacker replaces a platform archive with a malicious executable using the expected filename.
3. A user follows the README and downloads the archive without validating its signature or checksum.
4. The user launches the login executable under their normal operating-system account.
5. The malicious binary reads account cookies o ...[truncated 822 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the placeholder repository URL with the verified official project repository.
2. Pin downloads to an immutable release version and commit hash rather than a mutable branch or latest-release URL.
3. Publish SHA-256 or stronger checksums for every platform artifact and instruct users to verify them before extraction or execution.
4. Cryptographically sign releases and document signature verification using a trusted maintainer key or a service such as Sigstore.
5. Prefer reproducible builds from reviewed source code where practical.
6. Run the MCP service under a dedicated, unprivileged operating-system account with access only to the required cookie and configuration files.
7. Avoid recommending elevated execution and document that the binaries must never be run with administrator or root privileges.
8. Bind the MCP endpoint exclusively to loopback and enforce authentication or capability restrictions for sensitive account operations.
9. Document how users can stop the background service and verify the identity and integrity of the running executable.

T09 · Insecure Skill Coding Practices

Warning

• Location: README.md:69

Finding

Realistic Authentication Token Is Embedded in Command Documentation

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 69-73
Vulnerability Type: Hardcoded token-like sensitive value
Risk Level: Medium

Vulnerable Code

bash

mcporter call xiaohongshu get_feed_detail \
  feed_id="68bc3f17000000001d035c33" \
  xsec_token="AB_wL6p9ZA0PmODiLLL97TQ7vx9xvg6rVG655oG2Za6XA="

Technical Analysis

The documentation contains a realistic xsec_token value rather than an unmistakable placeholder. The audited files do not establish that the value is synthetic, expired, or revoked.

Tokens of this kind may authorize access to feed details or other protected resources. Committing a usable token to a repository exposes it to every reader, repository mirror, package consumer, search index, and retained version-control history. Removing it only from the current file would not reliably eliminate copies preserved in prior commits or external caches.

Even if this particular value is synthetic, presenting it as a literal value encourages unsafe credential handling and may lead users to place live tokens in scripts, documentation, shell history, or source control.

Attack Path

1. An attacker reads or indexes the public project documentation.
2. The attacker extracts the embedded feed identifier and xsec_token.
3. The attacker submits them to a compatible Xiaohongshu API or MCP service before the token expires or is revoked.
4. If the token remains valid and provides the required authorization context, the attacker retrieves content associated with the protected resource.
5. The token may also be tested against other compatible operations if its authorization scope is broader than the documented request.

Impact Assessment

If the embedded value is valid, exploitation could disclose protected feed content or metadata available within the token's authorization scope. The exact privileges and expiration cannot be established from the audited files, so broader account ...[truncated 179 chars]

Remediation

View remediation

Remediation Suggestions

1. Determine whether the documented token was ever valid. If so, revoke or invalidate it immediately.
2. Remove the token from the current documentation and, where feasible, purge it from version-control history and published artifacts.
3. Replace the literal value with an unmistakable placeholder such as ${XSEC_TOKEN}.
4. Retrieve short-lived tokens dynamically from the legitimate search response or authenticated runtime workflow.
5. Pass sensitive values through protected runtime configuration rather than source files or command examples.
6. Warn users that command-line arguments may be recorded in shell history or visible to local process-monitoring tools.
7. Add automated secret scanning to commits and release pipelines to prevent future publication of credentials or token-like values.
8. Limit token scope and lifetime so that accidental exposure cannot grant access beyond the minimum required resource and duration.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The README expands the skill from read-only search/browsing into write-capable account actions such as liking, favoriting, and commenting. This creates a scope mismatch between the stated purpose and the documented capabilities, which can mislead users or downstream agents into invoking actions that alter the user's Xiaohongshu account state.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README advertises like, favorite, and comment operations without clearly warning that these are state-changing actions on the user's real Xiaohongshu account. In an agent setting, missing disclosure increases the risk of unintended social actions, account history changes, or policy violations triggered through normal-looking tool use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The login/setup flow relies on persistent cookies but does not warn users that authentication material will be stored locally. This omission can lead users to leave sensitive session data on disk without understanding the persistence or security implications, increasing the chance of credential theft or account misuse on shared systems.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 78% confidence

Finding

Running the MCP service under nohup creates a long-lived local process that preserves authenticated session access via stored cookies. In the context of a localhost service controlling a real account, persistent unattended execution increases the window for local misuse, accidental invocation by other software, or continued access after the user believes the session is inactive.

Content

Scanner excerpt · README.md (reported line 35)May include surrounding context.

首次登录

./xiaohongshu-login-darwin-arm64

启动 MCP 服务

nohup ./xiaohongshu-mcp-darwin-arm64 > ../mcp.log 2>&1 &

text

### 3. 配置 mcporter

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

Documenting access to user profile information goes beyond the stated purpose of searching interview notes and related content. While not inherently malicious, this broader data access increases privacy exposure and violates least-privilege expectations for a narrowly described search skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest description and user-facing instructions are entirely in Chinese and presume Chinese-language interaction, with no indication that the user can choose another language. The policy for natural-language issues says to flag language or locale constraints unless the skill offers an opt-in choice or clearly justifies the restriction.

Content

No source excerpt is available for this finding.