T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/setup.py:19- Finding
Mutable, Unverified Third-Party Binaries Are Downloaded and Executed
- Content
View full analysis
- Remediation
View remediation
Security audit
xhs-research
Security checks for vulnerabilities and agentic risk
Overview
The skill is a real Xiaohongshu research helper, but it installs and runs unverified downloaded binaries, stores login cookies, and has an undocumented endpoint override that can send research data outside localhost.
Review this before installing if you are comfortable running unaudited third-party binaries tied to a Xiaohongshu login. Prefer a version that pins and verifies downloaded releases, restricts the API endpoint to localhost unless you explicitly opt in, and documents how to delete cookies, logs, binaries, and saved reports.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/xhs_research.py:30- Finding
Environment-Controlled API Endpoint Can Receive Search Queries and Xiaohongshu Access Tokens
- Content
View full analysis
List[Dict]: """Search XHS with a single keyword. Returns list of note dicts.""" payload = { "keyword": keyword, "filters": { "sort_by": "综合", "note_type": "不限", "publish_time": publish_time, "search_scope": "不限", "location": "不限", }, } resp = _http_post_json(f"{MCP_BASE}/api/v1/feeds/search", payload, timeout=30, retries=3) ``` ```python # scripts/xhs_research.py:439-444 detail = _http_post_json( f"{MCP_BASE}/api/v1/feeds/detail", {"feed_id": item["feed_id"], "xsec_token": item["xsec_token"]}, timeout=20, retries=2, ) ``` ### Technical Analysis The application defaults to a localhost MCP endpoint, but the inherited `XIAOHONGSHU_API_BASE` environment variable can replace it with an arbitrary URL. The value is used directly without validating the scheme, hostname, destination address, or transport security. As a result, search keywords, feed identifiers, and Xiaohongshu `xsec_token` values may be sent to a remote attacker-controlled endpoint. Because an `http://` URL is accepted, these values may also be transmitted without transport encryption. This behavior conflicts with the security statement in `SKILL.md`, which says searches use a localhost service and do not directly send data externally. The override therefore expands the network privilege boundary beyond what is disclosed and beyond the minimum needed for the default local-service archi ...[truncated 1750 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (19)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The declared purpose omits process management, health checks, port-bound local services, log creation, and use of persistent authentication state. In context, this makes the skill more dangerous because it handles browser login state and background service operation while appearing to be a straightforward content-research helper, which can mislead users about the security-sensitive side effects.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The declared purpose omits process management, health checks, port-bound local services, log creation, and use of persistent authentication state. In context, this makes the skill more dangerous because it handles browser login state and background service operation while appearing to be a straightforward content-research helper, which can mislead users about the security-sensitive side effects.
- Content
Lp1
High
- Category
- MCP Least Privilege
- Confidence
- 75% confidence
- Finding
The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
- Content
Lp1
High
- Category
- MCP Least Privilege
- Confidence
- 75% confidence
- Finding
The skill uses 'network' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
- Content
Env Variable Harvesting
High
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
- Content
python info(f"Starting {os.path.basename(mcp_bin)} on port {MCP_PORT}...") env = os.environ.copy() env["COOKIES_PATH"] = COOKIES_PATH try:
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The README encourages automatic dependency installation and browser-based login while downplaying the implications of local persistence. Because the skill stores a login cookie and downloaded executable components under user directories, users may unknowingly leave reusable authentication material and third-party code on disk, increasing risk from local compromise, token theft, or unsafe updates. In this context, the danger is elevated because the tool explicitly handles authenticated access to a user account and auto-installs an external MCP component.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The README tells users that scanning a QR code is the only required action and later documents a persistent cookie file path, but it does not clearly warn that authentication cookies will be stored locally and can grant ongoing access to the user's account. In a skill that automates login to a consumer platform, lack of explicit notice about credential persistence increases the risk of unintended account exposure, especially on shared machines or when users ask another agent/tool to modify local code and files.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill instructions, examples, status messages, and required user-facing outputs are written entirely in Chinese and prescribe exact Chinese phrases to show the user, such as the login notice and follow-up prompts. There is no indication that the user may choose another language or that the skill is intentionally limited to a Chinese-only compliance context, which creates a natural-language locale policy concern.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 88% confidence
- Finding
This is a duplicate persistence issue at the same location: the skill directs writing session-derived output to disk in a stable, user-accessible directory. In this skill's context, that is more concerning because the workflow also involves login state and personalized research topics, making the saved artifacts potentially privacy-sensitive.
- Content
Step 4: 保存报告
合成完报告后，用 Write 工具保存到本地：
text 路径：~/Documents/XHS-Research/{主题}-{YYYYMMDD}.md
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 88% confidence
- Finding
This is a duplicate persistence issue at the same location: the skill directs writing session-derived output to disk in a stable, user-accessible directory. In this skill's context, that is more concerning because the workflow also involves login state and personalized research topics, making the saved artifacts potentially privacy-sensitive.
- Content
Step 4: 保存报告
合成完报告后,用 Write 工具保存到本地:
text 路径:~/Documents/XHS-Research/{主题}-{YYYYMMDD}.md
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The file header says this is a '语音转文字工具' research report, while the skill manifest says the skill is a general Xiaohongshu research tool for searching notes and synthesizing reports. This is an active documentation contradiction about what topic/output this artifact represents, not merely an omitted detail.
- Content
Bundled hooks can execute when matching lifecycle events occur.
Medium
- Category
- Bundled Execution Surface
- Confidence
- 95% confidence
- Finding
This skill bundles a SessionStart hook that automatically executes a local Python script whenever the skill/session lifecycle event fires. Auto-executing bundled code increases attack surface because users may trigger code execution simply by enabling or starting the skill, without a narrow scope or explicit per-use confirmation in this file.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The empty matcher means the SessionStart hook applies broadly, so the Python command will run on every session start rather than only in a narrowly defined context. That makes unintended or surprise code execution more likely and increases the blast radius of any unsafe behavior in the hooked script.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python print() try: result = subprocess.run([login_bin], cwd=XHS_DIR) if result.returncode != 0: fail(f"Login process exited with code {result.returncode}") sys.exit(1)
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python ok, fail, info, ) GITHUB_API = f"https://api.github.com/repos/{MCP_REPO}/releases/latest" def download_mcp_binaries() -> bool:
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python try: log_path = os.path.join(BIN_DIR, "mcp-server.log") log_file = open(log_path, "a") subprocess.Popen( [mcp_bin, "-port", f":{MCP_PORT}", "-headless"], env=env, stdout=log_file, stderr=log_file, start_new_session=True,
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 75% confidence
- Finding
The skill is described as requiring the Xiaohongshu app and QR-code login to research content on a Chinese platform, and the examples and workflow implicitly assume Chinese-platform usage. While this may be practical for the service, the file does not explicitly offer language/locale choice or clearly document the locale restriction as an intentional region-specific limitation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The README presents the skill as specifically for Xiaohongshu research and all invocation examples, prompts, and output framing are in Chinese, with no indication that users can choose another language or locale. This can be a natural-language locale constraint that is not offered as an opt-in choice.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
This markdown file is entirely presented in Chinese from the title onward, with no indication that the language is optional or that the skill/report is specifically intended for a Chinese-only audience. Under the language/locale policy rule, forcing a specific language without opt-in can be a natural-language policy concern.
- Content