小红书MCP增强版 by Chaceclaw

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:43 AM UTC
• Version: 1.0.1

Overview

This skill is a disclosed Xiaohongshu automation pack, but it asks users to run unpinned third-party services and store full account session cookies while enabling public account actions.

Review carefully before installing. Only use this with an account you are prepared to automate, avoid pasting cookies into chat or logs, prefer pinned and verified MCP package/image versions, and do not run public write actions or batch interactions without explicit confirmation and clear rate limits.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Error

• Location: setup-xhs-mcp/SKILL.md:57

Finding

Unpinned and Unverified Executable Dependencies

Content

View full analysis

Remediation

View remediation

``` 7. Verify package provenance, signatures, checksums, and release attestations before execution. 8. Run the MCP service under a dedicated, unprivileged account with access only to the minimum required credential and media locations. 9. Restrict container privileges with a read-only root filesystem, dropped Linux capabilities, resource limits, and narrowly scoped read-only mounts where possible. 10. Require security review before updating the pinned package version or image digest. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: setup-xhs-mcp/SKILL.md:95

Finding

Overbroad Extraction and Plaintext Storage of Session Cookies

Content

View full analysis

~/.config/xiaohongshu/config.json << 'EOF' { "cookies": "your Cookie string", "device_id": "optional device ID", "update_interval": 43200 } EOF # Set permissions to reduce disclosure chmod 600 ~/.config/xiaohongshu/config.json ``` From `xhs-login/SKILL.md`: ```python # Set the cookie directly await mcp.set_cookies({ "cookies": "complete Cookie string", "device_id": "optional device ID" }) # Verify cookie validity status = await mcp.check_login_status() assert status["logged_in"], "Invalid cookie" ``` ```bash # Method 1: Export with the EditThisCookie browser extension # Method 2: Chrome DevTools → Application → Cookies and copy the values # Method 3: Xiaohongshu App → Settings → Account and Security → Login Device Management ``` ### Technical Analysis The instructions direct users to export or copy a complete cookie string rather than identifying the minimum set of XHS authentication cookies required by the MCP service. They also recommend giving a third-party browser extension access to cookie material. Session cookies are bearer credentials and may permit account access without the account password. Exporting all cookie ...[truncated 1943 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: xhs-interact/SKILL.md:332

Finding

State-Changing Like Operation Used as a Diagnostic Probe

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (50)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger scope is overly broad because it activates not only on explicit mentions of 小红书/XHS, but also on loosely related phrases like '写一篇种草笔记' or '帮我分析这个博主'. This can cause the skill to hijack unrelated requests and route users into a high-capability automation flow that can publish content, interact publicly, or inspect profiles on the wrong platform.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Broad triggers like '安装', '配置', '第一次用', and 'setup' are generic phrases that can activate this sensitive setup skill in unrelated contexts. Unintended invocation can expose users to credential-handling instructions and risky deployment commands when they did not explicitly request Xiaohongshu automation setup.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill instructs users to export and copy full authenticated browser cookies but does not clearly warn that these are equivalent to active session credentials and must never be shared broadly. Users may paste them into chat, logs, or insecure files, enabling account takeover and unauthorized actions.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The instructions explicitly direct operators to copy full authenticated browser cookies into a local config file, which normalizes handling session secrets in plain text and outside secure secret-management channels. Anyone with access to the file, backups, shell history, or copied content can reuse those cookies to impersonate the user and control the account.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The natural-language instructions are written entirely in Chinese and direct the assistant's behavior for user interaction, but they do not indicate that language selection is optional or user-driven. Under the policy, forcing a specific language without opt-in can be a locale/language policy violation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger list contains very broad and ambiguous terms such as "RED", "种草", and "博主", which can match ordinary conversation or unrelated requests and cause this social-media automation skill to activate unexpectedly. Because the skill enables account actions like posting, liking, collecting, and commenting, accidental invocation could lead to unintended platform interactions, privacy exposure, or misuse of an authenticated account.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

Natural-language content throughout the file is Chinese-only, including the description, trigger phrases, and procedural instructions. There is no indication that the skill is intentionally limited to Chinese-speaking users or that an alternative language is available, which may conflict with language-choice policy expectations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The markdown activation examples are ambiguous and lack clear boundaries, increasing accidental routing to a skill that contains deployment and credential-ingestion instructions. In context, misrouting is more dangerous because this skill directly teaches users to export authenticated cookies and run third-party code.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The skill tells operators to execute an unpinned package via npx using '@latest', which delegates trust to whatever code is current in the registry at runtime. If the package is compromised, typo-squatted, or a malicious update is published, users could execute arbitrary code during setup with no integrity verification.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The version-check command also references the package without a pinned version, so it may fetch and run whatever current package is published rather than validating a previously installed trusted artifact. This preserves the same supply-chain execution risk during a seemingly harmless verification step.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The OpenClaw configuration stores an execution command that will later invoke an unpinned npx package, creating persistent exposure to future malicious or breaking upstream releases. This turns a one-time supply-chain risk into a recurring remote-code-execution pathway whenever the MCP service is launched.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

Pulling a Docker image tagged 'latest' is not reproducible and can silently introduce unreviewed or malicious image changes. In a deployment guide, this can lead users to run attacker-controlled containers or unexpectedly different software than intended.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 84% confidence

Finding

The 'docker run' step launches whatever 'xiaohongshu-mcp:latest' currently resolves to, inheriting the same mutable-image risk as the preceding pull. Since the container is run detached and stores credentials under a mounted host path, a compromised image could persistently access sensitive account material.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

This duplicate finding reflects the same risky behavior: storing authenticated session cookies in a local config path for later reuse. In the context of an automation skill, persistent reusable sessions materially raise the blast radius of any endpoint compromise or accidental disclosure.

Content

Scanner excerpt · setup-xhs-mcp/SKILL.md (reported line 112)May include surrounding context.

bash

# 创建配置文件
mkdir -p ~/.config/xiaohongshu

# 写入认证信息
cat > ~/.config/xiaohongshu/config.json << 'EOF'

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

This duplicate finding reflects the same risky behavior: storing authenticated session cookies in a local config path for later reuse. In the context of an automation skill, persistent reusable sessions materially raise the blast radius of any endpoint compromise or accidental disclosure.

Content

Scanner excerpt · setup-xhs-mcp/SKILL.md (reported line 112)May include surrounding context.

bash

# 创建配置文件
mkdir -p ~/.config/xiaohongshu

# 写入认证信息
cat > ~/.config/xiaohongshu/config.json << 'EOF'

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · setup-xhs-mcp/SKILL.md (reported line 124)May include surrounding context.

EOF

权限设置（防止泄露）

chmod 600 ~/.config/xiaohongshu/config.json

text

---

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The restart instruction again relies on an unpinned npx package, so remediation steps for outages could unexpectedly pull and execute new code from the package registry. Operational recovery paths are often followed under pressure, making this a realistic supply-chain attack surface.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill includes guidance for handling IP restrictions and device-risk detections in ways that help operators adapt to or work around platform anti-abuse controls, which goes beyond basic MCP deployment. This increases the chance the skill is used to evade safeguards and sustain automated activity under platform scrutiny.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · setup-xhs-mcp/SKILL.md (reported line 246)May include surrounding context.

bash

# 调用刷新接口
curl -X POST http://localhost:3100/refresh \
  -H "Content-Type: application/json" \
  -d '{"force": true}'

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The completion checklist reinforces the unpinned installation command, normalizing unsafe execution practices across repeated use and copy-paste adoption. Because this is a setup skill, operators are especially likely to trust and reuse these exact commands broadly.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The entire skill is written only in Chinese and presents mandatory guidance without offering any language or locale choice. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is clearly documented and justified; this file does not explicitly state that it is intended only for Chinese-speaking users or a China-specific workflow.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger list is broad and generic, including terms like '选题', '爆款', '涨粉', and 'content', which can match many ordinary requests outside a clearly intended XHS-specific context. This can cause unintended skill invocation, leading the agent to route user requests into the wrong capability domain and potentially perform or suggest platform-specific actions when the user did not intend to use this skill.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The '何时触发' examples are phrased as common, high-level requests like '帮我策划内容' and '怎么涨粉', without boundaries tying them specifically to XiaoHongShu. In an agent environment, such ambiguity increases the chance of accidental invocation on unrelated marketing or content-planning requests, which can misroute user intent and create unsafe or unauthorized cross-tool behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill description advertises note browsing, detail scraping, comment collection, and content analysis but provides no user-facing warning about privacy, consent, or data handling. Because the documented outputs include user nicknames, IDs, comments, and metadata, omission of disclosure raises privacy and compliance risks.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger phrases are broad everyday terms like browsing and recommendation that can cause the skill to activate outside clearly intended XHS-specific requests. Overbroad activation increases the chance of unintended data collection or automation being invoked without clear user intent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.