小红书数据分析

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:34 AM UTC
• Version: 1.0.0

Overview

The skill is not obviously malware, but it asks for Xiaohongshu credentials while its scripts mostly return sample data that could be mistaken for real analytics.

Treat this as a demo or scaffold unless the publisher documents and implements real data collection. Do not provide Xiaohongshu cookies or API keys until credential handling, network destinations, and sample-data labeling are explicit; avoid proxying account traffic through untrusted infrastructure.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description presents a broader Xiaohongshu analytics tool with capabilities for collecting note data, analyzing heat, tracking competitors, and generating reports. The supplied code only implements a narrow note trend lookup interface and, in practice, always returns static sample data. Although it reads XHS_API_KEY and XHS_COOKIE from the environment, it never uses them to access external resources. There is no competitor analysis, no report generation, and no actual data acquisition. This is a material description-to-behavior mismatch because the implementation is substantially more limited than the declared purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description presents a broader analytics tool covering data collection, heat/popularity analysis, competitor tracking, and report generation. The supplied code only provides a note-search CLI with formatting/output features. More importantly, the real network/API collection logic is not implemented; the function returns sample data regardless, with only commented placeholders for actual API calls. This is a material description-versus-behavior mismatch because the primary advertised capabilities are absent from the code chunk.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence

Finding

The skill documents capabilities that require environment secrets, outbound network access, and report/file generation, but it declares no explicit tool scope or permissions boundary. In an agent setting, this increases the chance that the skill is granted broader access than necessary, enabling unintended credential exposure, arbitrary network requests, or unsafe file writes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs users to place API keys and cookies in configuration and mentions third-party data services, but it does not adequately warn about secret handling, storage risks, or outbound transmission to external services. Cookies may grant account access, and unclear handling practices materially increase the risk of credential leakage or misuse.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The troubleshooting guidance advises using a proxy when requests are restricted, which can facilitate bypassing platform controls and encourages routing potentially sensitive traffic through intermediary infrastructure. In the context of a skill that uses cookies and API credentials, this raises abuse, interception, and compliance risks.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file-level docstring and usage text are entirely in Chinese, and the CLI/help descriptions later in the file also assume Chinese-language interaction. Under the policy, forcing a specific language without opt-in or justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file header and usage text imply genuine competitor comparison functionality, but the implementation only emits example data. This mismatch creates a security-relevant integrity issue because users can be misled into trusting non-authentic analytics as if they were collected from the platform.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This code file contains natural-language strings that constrain usage to Chinese, including the module docstring and CLI descriptions. The policy requires avoiding forced language/locale behavior unless the skill offers user choice or clearly documents a justified locale-specific constraint.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script presents itself as a Xiaohongshu competitor-analysis tool but always returns fabricated sample data, even when API credentials are present. This is dangerous because downstream users or agents may treat the output as real competitive intelligence, leading to deceptive reporting, bad business decisions, and loss of trust.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This shell file contains user-facing natural-language instructions entirely in Chinese, including setup guidance for credentials and runtime options. Under the language/locale policy, forcing a specific language without opt-in or justification is a policy concern.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module-level documentation advertises a data collection/search tool, but the script currently produces example data rather than real search results. In the context of a data-analysis skill, this is security-relevant because it can deceive downstream automation, reports, or operators into trusting non-existent external data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This file contains natural-language instructions and argument descriptions exclusively in Chinese, which can impose a specific language on users without opt-in. The policy calls for flagging language or locale constraints unless the skill offers choice or clearly documents a justified regional limitation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The function is documented and exposed as a Xiaohongshu note search capability, but it always returns fabricated sample data, including when credentials are present. In an analytics skill, this can mislead users into making business or compliance decisions based on false results, and the hidden substitution of fake data undermines integrity and trust.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The skill description and instructions are presented in Chinese only, which can amount to a language/locale constraint without user opt-in. The file does not indicate that the skill is intentionally region-specific or offer an alternative language option.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The file’s user-facing description and usage text are presented only in Chinese. Under the policy rule for natural-language violations, forcing a specific language without user opt-in can be a locale-policy issue when no alternative or justification is provided.

Content

No source excerpt is available for this finding.