Security audit

XHS Image Gen

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly coherent for creating and publishing Xiaohongshu notes, but it handles a full account cookie in ways that deserve careful review before installation.

Install only if you are comfortable giving the skill access to a Xiaohongshu session cookie. Keep .env local and out of source control, prefer a dedicated account, use dry-run and private posting first, avoid --api-mode unless the API service is your own trusted local service, and do not render Markdown from untrusted sources without sandboxing or sanitization.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/publish_xhs.py:205
Finding: Full Authentication Cookie Can Be Forwarded to an Arbitrary API Endpoint
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/render_xhs.py:105
Finding: Untrusted Markdown and Metadata Are Rendered as Active Browser HTML
Content: View full analysis
str: """Convert Markdown to HTML""" tags_pattern = r'((?:#[\w\u4e00-\u9fa5]+\s*)+)$' tags_match = re.search(tags_pattern, md_content, re.MULTILINE) tags_html = "" if tags_match: tags_str = tags_match.group(1) md_content = md_content[:tags_match.start()].strip() tags = re.findall(r'#([\w\u4e00-\u9fa5]+)', tags_str) if tags: tags_html = '
' for tag in tags: tags_html += f'#{tag}' tags_html += '
' html = markdown.markdown( md_content, extensions=['extra', 'codehilite', 'tables', 'nl2br'] ) return html + tags_html ``` YAML metadata is interpolated directly into cover HTML without HTML escaping: ```python
{emoji}

{title}

{subtitle}
``` Converted Markdown is also inserted directly: ```python

{html_content}

``` The resulting document is loaded into Chromium from a `file://` origin: ```python with tempfile.NamedTemporaryFile( mode='w', suffix='.html', delete=False, encoding='utf-8' ) as f: f.write(html_content) temp_html_path = f.name try: await page.goto(f'file://{temp_html_path}') await page.wait_for_load_state(' ...[truncated 2984 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: requirements.txt:4
Finding: Open-Ended Dependency Constraints Permit Unreviewed Future Package Code
Content: View full analysis
=3.4.0 PyYAML>=6.0 # Browser automation playwright>=1.40.0 # Xiaohongshu publishing xhs>=0.4.0 # Environment variable management python-dotenv>=1.0.0 # HTTP requests requests>=2.28.0 ``` Node.js dependencies also use version ranges: ```json "dependencies": { "js-yaml": "^4.1.0", "marked": "^11.0.0", "playwright": "^1.58.0" } ``` No Python hash lock or Node.js lockfile was present in the audited project structure. ### Technical Analysis The declared version ranges make installations non-reproducible. A future package release that satisfies `>=` or caret constraints can be installed without any source change to this project. This is particularly sensitive for the `xhs` package because it receives the complete Xiaohongshu cookie and performs authenticated account operations. Playwright and the Markdown libraries also process attacker-influenced content and execute substantial third-party code. The audit did not identify a currently malicious dependency, dependency-confusion name, or confirmed compromised release. The vulnerability is the absence of controls that ensure reviewed dependency versions are the versions actually installed. ### Attack Path 1. A dependency account or release channel is compromised, or a future compatible release introduces malicious behavior. 2. The malicious version still satisfies an open constraint such as `xhs>=0.4.0` or `playwright>=1.40.0`. 3. A user follows the documented installation command: ```bash pip install -r requirements.txt ``` or: ```bash npm install ``` 4. The package manager downloads the newer, unreviewed release. 5. Pa ...[truncated 848 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (72)

Credential Access

High

Category: Privilege Escalation
Confidence: 91% confidence
Finding: The documented workflow explicitly tells users to create a .env file to hold a live authenticated cookie, which centralizes a highly sensitive credential for an automation tool that can publish on the user's behalf. In the context of an agent skill for social-media automation, this is more dangerous because users may install and run it with broad filesystem/tool access, increasing the chance of secret leakage or misuse.
Content: Scanner excerpt · README.md (reported line 136)May include surrounding context.
1. 配置 Cookie

bash
cp env.example.txt .env

编辑 .env：

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: This is another instance of the same core problem: the skill declaration suggests broader automated creation and publishing than the implementation supports. In a skill that may touch credentials and files, inaccurate behavior claims increase operational risk because users may invoke it in situations where tighter scrutiny or consent would otherwise be required.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: This is another instance of the same core problem: the skill declaration suggests broader automated creation and publishing than the implementation supports. In a skill that may touch credentials and files, inaccurate behavior claims increase operational risk because users may invoke it in situations where tighter scrutiny or consent would otherwise be required.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: This is another instance of the same core problem: the skill declaration suggests broader automated creation and publishing than the implementation supports. In a skill that may touch credentials and files, inaccurate behavior claims increase operational risk because users may invoke it in situations where tighter scrutiny or consent would otherwise be required.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: This is another instance of the same core problem: the skill declaration suggests broader automated creation and publishing than the implementation supports. In a skill that may touch credentials and files, inaccurate behavior claims increase operational risk because users may invoke it in situations where tighter scrutiny or consent would otherwise be required.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: This is another instance of the same core problem: the skill declaration suggests broader automated creation and publishing than the implementation supports. In a skill that may touch credentials and files, inaccurate behavior claims increase operational risk because users may invoke it in situations where tighter scrutiny or consent would otherwise be required.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: This is another instance of the same core problem: the skill declaration suggests broader automated creation and publishing than the implementation supports. In a skill that may touch credentials and files, inaccurate behavior claims increase operational risk because users may invoke it in situations where tighter scrutiny or consent would otherwise be required.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · env.example.txt (reported line 2)May include surrounding context.
text
# 小红书 Cookie 配置 # 将此文件复制为 .env 并填入真实的 Cookie # # 获取方式： # 1. 在浏览器中登录小红书 (https://www.xiaohongshu.com)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/publish_xhs.py (reported line 14)May include surrounding context.
python
# 小红书 Cookie 配置 # 将此文件复制为 .env 并填入真实的 Cookie # # 获取方式： # 1. 在浏览器中登录小红书 (https://www.xiaohongshu.com)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/publish_xhs.py (reported line 44)May include surrounding context.
python
# 小红书 Cookie 配置 # 将此文件复制为 .env 并填入真实的 Cookie # # 获取方式： # 1. 在浏览器中登录小红书 (https://www.xiaohongshu.com)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/publish_xhs.py (reported line 45)May include surrounding context.
python
# 小红书 Cookie 配置 # 将此文件复制为 .env 并填入真实的 Cookie # # 获取方式： # 1. 在浏览器中登录小红书 (https://www.xiaohongshu.com)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/publish_xhs.py (reported line 60)May include surrounding context.
python
# 小红书 Cookie 配置 # 将此文件复制为 .env 并填入真实的 Cookie # # 获取方式： # 1. 在浏览器中登录小红书 (https://www.xiaohongshu.com)

Credential Access

High

Category: Privilege Escalation
Confidence: 89% confidence
Finding: Using a .env file for secrets is common, but in this skill context it is paired with instructions to place a live browser-derived authentication cookie into that file. That creates a real credential exposure risk because .env files are frequently mishandled, copied, or accidentally committed, and the skill provides no compensating safeguards.
Content: Scanner excerpt · references/params.md (reported line 107)May include surrounding context.
环境变量配置（.env）

bash
cp env.example.txt .env

编辑 .env：

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/publish_xhs.py (reported line 47)May include surrounding context.
python
"""从 .env 文件加载 Cookie""" # 尝试从多个位置加载 .env env_paths = [ Path.cwd() / '.env', Path(__file__).parent.parent / '.env', Path(__file__).parent.parent.parent / '.env', ]

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/publish_xhs.py (reported line 48)May include surrounding context.
python
"""从 .env 文件加载 Cookie""" # 尝试从多个位置加载 .env env_paths = [ Path.cwd() / '.env', Path(__file__).parent.parent / '.env', Path(__file__).parent.parent.parent / '.env', ]

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/publish_xhs.py (reported line 49)May include surrounding context.
python
"""从 .env 文件加载 Cookie""" # 尝试从多个位置加载 .env env_paths = [ Path.cwd() / '.env', Path(__file__).parent.parent / '.env', Path(__file__).parent.parent.parent / '.env', ]

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README instructs users to extract their full authenticated Xiaohongshu session cookie from browser developer tools and store it in .env for automated publishing. A full session cookie is effectively an account bearer token; if exposed through logs, backups, shell history, malware, or accidental sharing, it can enable account takeover or unauthorized posting.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill advertises capabilities that involve reading local files, consuming environment secrets, and potentially performing network-backed publishing, but it does not declare any explicit tool scope or permission boundaries. This is dangerous because an agent or reviewer cannot easily determine what resources the skill is allowed to access, increasing the chance of overbroad execution and secret exposure such as XHS_COOKIE.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest description and title describe the skill exclusively as a 小红书 note creation skill and the instructions throughout the file are written to produce content in that platform's Chinese-language style, but there is no statement that the user can choose another language or locale. This can violate a language/locale policy when a skill implicitly forces a specific language or regional format without explicit opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The document language is hard-coded to zh-CN, which imposes a specific language/locale setting. There is no nearby natural-language explanation that this template is region-specific or that users can opt into a different locale.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The document declares lang="zh-CN", which hard-codes a specific language/locale. Under the policy, locale constraints should either offer user choice or be clearly documented as justified for a region-specific skill, which is not present in this file.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This markdown file presents the skill content entirely in Chinese and targets '小红书笔记' creation without indicating that language selection is optional. Under the policy rule, a skill that implicitly forces a specific language or locale without opt-in should be flagged unless the locale constraint is clearly documented and justified.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 86% confidence
Finding: The install script invokes npx playwright install chromium, which can resolve and execute a package based on the environment's package state rather than a tightly controlled, explicitly pinned binary. In build or agent environments, this weakens supply-chain guarantees and can result in unexpected code execution or installation behavior if resolution is manipulated or a different package version is used than intended.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The document instructs users to extract and store a full Xiaohongshu session cookie in a local .env file, but it provides no warning that this cookie is a highly sensitive authentication secret equivalent to account access. If the file is exposed through source control, logs, backups, or shared environments, an attacker could reuse the cookie to publish content or access the account.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 93% confidence
Finding: This request transmits sensitive authentication material and session state to an API endpoint, expanding the trust boundary beyond the local script. In the context of a publishing skill that operates on a real social-media account, external transmission of cookies can directly enable account takeover or unauthorized posting if the endpoint or network path is compromised.
Content: Scanner excerpt · scripts/publish_xhs.py (reported line 227)May include surrounding context.
python
# 初始化 session try: resp = requests.post( f"{self.api_url}/init", json={ "session_id": self.session_id,

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T08 · Insecure Dependencies

SkillSpector

Credential Access

1. 配置 Cookie

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

环境变量配置（.env）

Credential Access

Credential Access

Credential Access

Missing User Warnings

Undeclared Tool Scope

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations

Rp1

Missing User Warnings

External Transmission

Static analysis