Security audit

小红书自动排版发布---一键安装

Security checks for vulnerabilities and agentic risk

Overview

This skill appears purpose-built for Xiaohongshu publishing, but it stores reusable login state and has installer hardening issues that users should review before installing.

Install only if you are comfortable giving this skill local OpenClaw workspace access and a reusable Xiaohongshu browser session. Treat ~/.openclaw/workspace-xiaohongshu-publisher/.session/state.json like a credential, do not share or sync it, review the setup script before running it, and prefer pinned Playwright dependencies.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/setup.cjs:9
Finding: Shell Command Injection Through OPENCLAW_HOME
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/xhs_publish.cjs:33
Finding: Authenticated Browser Session Stored Without Explicit Access Restrictions
Content: View full analysis
{ return document.cookie.includes('web_session') || document.querySelector('[class*="user-info"]') || document.querySelector('[class*="avatar"]'); }, { timeout: 120000 } ); } catch (e) { console.log(' 等待超时，请检查是否已完成登录后按 Enter 继续...'); await new Promise(resolve => process.stdin.once('data', resolve)); } await context.storageState({ path: SESSION_FILE }); console.log(`✅ 登录成功，session 已保存至：${SESSION_FILE}`); await browser.close(); } ``` ### Technical Analysis Playwright storage-state files may contain cookies and local-storage values that represent an authenticated browser session. Possession of this state can allow a new browser context to act as the logged-in user without repeating the QR-code login. The code creates the session directory using the generic `ensureDir` helper and writes the state file without explicitly enforcing restrictive permissions. Security therefore depends on the process umask, inherited directory permissions, filesystem behavior, and Playwright's ...[truncated 1394 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/xhs_publish.cjs:316
Finding: User-Controlled Note Identifier Used in Screenshot Output Path
Content: View full analysis
'); console.log(' 笔记ID 可在小红书创作者中心的笔记管理页面找到'); process.exit(1); } const { chromium } = await getPlaywright(); if (!fs.existsSync(SESSION_FILE)) { console.error('❌ 未找到登录 session，请先运行 login 命令'); process.exit(1); } const browser = await chromium.launch({ headless: true }); const context = await browser.newContext({ storageState: SESSION_FILE, }); const page = await context.newPage(); try { const dataUrl = `${XHS_CREATOR_URL}/data/note`; await page.goto(dataUrl, { waitUntil: 'networkidle', timeout: 30000 }); if (page.url().includes('login')) { console.error('❌ 登录已过期，请重新运行 login 命令'); await browser.close(); process.exit(1); } const screenshotPath = path.join(WORKSPACE_DIR, `note_data_${noteId}.png`); await page.screenshot({ path: screenshotPath, fullPage: true }); console.log(`📊 笔记数据页面截图已保存：${screenshotPath}`); console.log(` 请在截图中查看笔记 ${noteId} 的数据`); console.log(` 也可直接访问：${dataUrl}`); } catch (e) { console.error(`❌ 获取笔记数据失败：${e.message}`); await browser.close(); process.exit(1); } await browser.close(); } ``` ### Technical Analysis `noteId` is accepted directly from the command line and embedded in a filesystem path without validating its character set. Path separators and traversal components are therefore interpreted by `path.join`. Because the filename begins with `note_data_`, straightforward traversal is constrained, but a crafted identifier containing separators can introduce nested path components. If the necessary intermediate directories already exist, traversal sequences can resolve the screenshot outside its inten ...[truncated 1287 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:25
Finding: Unpinned Playwright and Browser Installation Instructions
Content: View full analysis
/dev/null && echo "OK" || echo "MISSING" ``` When the dependency is missing, the Skill instructs the user to run: ```bash npm install playwright npx playwright install chromium ``` Equivalent instructions are also printed by `scripts/setup.cjs` at lines 49-57 and by `scripts/xhs_publish.cjs` at lines 88-96 and 374-377. ### Technical Analysis The installation commands do not specify an audited Playwright version and the project does not provide a package manifest or lockfile. Consequently, installation resolves the dependency version available from the configured package registry at execution time rather than the version reviewed with this Skill. The `npx playwright install chromium` command then runs package-provided installer code and downloads a browser artifact. This is normal for Playwright, but without version pinning and lockfile enforcement, the effective dependency and browser payload may change after the Skill itself has been audited. This is a supply-chain hardening deficiency rather than evidence that the official Playwright package is malicious. ### Attack Path 1. A user follows the Skill's installation instructions. 2. `npm` resolves the current package version from the user's configured registry. 3. A compromised registry, compromised package release, malicious registry configuration, or unexpected future release supplies code different from the audited version. 4. Package lifecycle behavior or the subsequently invoked Playwright installer executes under the user's account. 5. The downloaded dependency obtains the same local access as the user running the installation. No direct exploit is demonstrated against the current official package; exploitation depends on compromise or substitution in the dependency-d ...[truncated 364 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Rogue AgentSelf-Modification, Session Persistence
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (24)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.
将账号信息写入配置：

bash
mkdir -p ~/.openclaw/workspace-xiaohongshu-publisher cat > ~/.openclaw/workspace-xiaohongshu-publisher/.env << 'EOF' XHS_ACCOUNT_NAME=用户输入的账号名 XHS_POSITIONING=用户输入的账号定位 XHS_TARGET_AUDIENCE=用户输入的目标受众

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.
将账号信息写入配置：

bash
mkdir -p ~/.openclaw/workspace-xiaohongshu-publisher cat > ~/.openclaw/workspace-xiaohongshu-publisher/.env << 'EOF' XHS_ACCOUNT_NAME=用户输入的账号名 XHS_POSITIONING=用户输入的账号定位 XHS_TARGET_AUDIENCE=用户输入的目标受众

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill performs file writes, environment persistence, agent registration, and invokes shell commands, yet it declares no explicit tool scope or permissions. This increases the chance that an agent or runtime grants broader capabilities than users expect, reducing transparency and weakening least-privilege controls.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 81% confidence
Finding: The setup instructs use of npx playwright install chromium without pinning a version, which can fetch whatever package/version is current at execution time. This creates supply-chain and reproducibility risk, especially for an automation skill that later handles authenticated browser sessions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill collects user profile/account information and writes it to a persistent local .env file without clearly warning the user that the data will be stored on disk and reused by multiple agents. Even if the fields are not passwords, they can still be sensitive business/profile data and may leak through backups, logs, or later prompts.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 85% confidence
Finding: The skill explicitly persists user-supplied account/profile information to ~/.openclaw/workspace-xiaohongshu-publisher/.env, creating durable local state that may later be read by agents or exposed through filesystem compromise. Persistent state is contextually more sensitive here because it is tied to a social-media publishing workflow and business identity.
Content: Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.
将账号信息写入配置：

bash
mkdir -p ~/.openclaw/workspace-xiaohongshu-publisher cat > ~/.openclaw/workspace-xiaohongshu-publisher/.env << 'EOF' XHS_ACCOUNT_NAME=用户输入的账号名 XHS_POSITIONING=用户输入的账号定位

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.
XHS_POST_FREQUENCY=用户输入的发布频率 XHS_FOLLOWER_SCALE=用户输入的粉丝规模 EOF chmod 600 ~/.openclaw/workspace-xiaohongshu-publisher/.env 2>/dev/null || true

text
## Step 3：部署文件

Session Persistence

Medium

Category: Rogue Agent
Confidence: 94% confidence
Finding: This duplicate finding points to the same .session directory creation and carries the same concern: the skill prepares local storage for reusable authenticated browser state. Because the skill is for automated Xiaohongshu publishing, persisted sessions directly increase the blast radius of local compromise or accidental sharing.
Content: Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

将 Step 2 收集的信息填充到两个 Agent 的 USER.md 中

创建 session 目录：
bash
mkdir -p ~/.openclaw/workspace-xiaohongshu-publisher/.session

输出进度：
text

Session Persistence

Medium

Category: Rogue Agent
Confidence: 94% confidence
Finding: This duplicate finding points to the same .session directory creation and carries the same concern: the skill prepares local storage for reusable authenticated browser state. Because the skill is for automated Xiaohongshu publishing, persisted sessions directly increase the blast radius of local compromise or accidental sharing.
Content: Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

将 Step 2 收集的信息填充到两个 Agent 的 USER.md 中

创建 session 目录:
bash
mkdir -p ~/.openclaw/workspace-xiaohongshu-publisher/.session

输出进度:
text

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill recommends browser login initialization and states that the session is automatically saved, but it does not prominently warn that this creates a reusable authenticated Xiaohongshu session on local disk. A stolen or reused session could allow account access and posting without re-authentication.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file’s user-facing description and runtime messages are entirely in Chinese, including setup guidance and next-step instructions. For a general deployment tool, this effectively forces a specific language/locale without any opt-in or documented regional justification in the file.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The script saves Playwright storage state to ~/.openclaw/workspace-xiaohongshu-publisher/.session/state.json, which can contain authentication cookies and other session material that may grant account access if copied. There is no explicit warning to the user about the sensitivity of this file, no permission hardening, and no encryption or lifecycle controls around the stored session.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill explicitly instructs the agent to persist session-derived content into memory/YYYY-MM-DD.md and MEMORY.md, but provides no user-facing notice, consent step, retention limit, or sensitivity filter. This creates a real privacy and data-governance risk because user drafts, account preferences, performance data, or accidental secrets could be stored long-term and later reused outside the original interaction context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The instruction states that the language should be Xiaohongshu-style 'girlfriend chat' rather than other styles, which imposes a specific linguistic register by default. Under the policy, forcing a specific language or locale without offering user choice can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: All natural-language instructions and constraints in this file are presented only in Chinese, which can amount to a language-policy violation when no user opt-in or alternative language support is offered. There is also no explicit statement that this skill is intentionally limited to a Chinese-language or region-specific workflow.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The tool list explicitly includes network search capabilities for topic and competitor research, but provides no warning that prompts or content may be transmitted to external services. In a content-publishing setup, users may reasonably provide drafts, strategy notes, or other sensitive business information, so the absence of privacy and data-sharing disclosure creates a real risk of unintended external exposure.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The entire user-facing template is written in Chinese and includes Chinese-specific content fields such as '爆款参考' and '笔记标题', which implies a fixed language/locale expectation. There is no indication that users may choose another language or locale, nor any justification that the skill is region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This markdown file presents all user-facing headings and instructions exclusively in Chinese, which can amount to a language/locale policy violation when no opt-in or alternative language is offered. The file does not state that the skill is intentionally region-specific or limited to Chinese-speaking users.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The script captures a full-page screenshot of the creator data page and saves it to disk without warning that it may include account metrics, note performance, profile details, or other sensitive business data. In the context of a publishing automation skill, persisting such images increases privacy and data-handling risk, especially on shared machines or synced home directories.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This markdown file presents all operational instructions and the required response format solely in Chinese, including the mandated output token context. Under the policy for natural-language violations, forcing a specific language without offering user choice can be a locale-policy issue.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/setup.cjs:25