Security audit

Xiaohongshu Ops

Security checks for vulnerabilities and agentic risk

Overview

This skill is not overtly malicious, but it needs Review because it can act on a real Xiaohongshu account, send replies, run workspace scripts, and retain content automatically with unclear boundaries.

Install only if you are comfortable giving the agent access to an authenticated Xiaohongshu workflow. Treat it as capable of preparing and sending real account content, and require explicit review before any post or reply. Disable or constrain automatic knowledge-base/style logging unless you want drafts, final copy, and operational history retained for future use. Verify any <WORKSPACE>/scripts tools before allowing them to run.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection

Findings (5)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:51
Finding: Mandatory Fixed-Persona Injection Can Produce Deceptive External Communications
Content: View full analysis
Remediation: View remediation

T02 · Agent Memory Poisoning

Error

Location: SKILL.md:245
Finding: Automatic Persistent Style Learning Can Poison Future Agent Behavior
Content: View full analysis
/scripts/style-observe.py record-original \ --skill xiaohongshu-ops --topic "topic keywords" python3 /scripts/style-observe.py record-final \ --skill xiaohongshu-ops python3 /scripts/style-observe.py pairs \ --skill xiaohongshu-ops --days 30 ``` The persona also directs the Agent to read persistent style state: ```markdown Use these scores as writing anchors. See /memory/style-runs/voice-dimensions.md for details. ``` ### Technical Analysis The Skill automatically records original drafts, final drafts, edits, outcomes, and style dimensions. That stored state is subsequently read as an authority for future writing behavior. Because note contents and final versions may be supplied or modified by users, collaborators, imported material, or compromised account content, the stored records can contain attacker-controlled instructions or adversarial text. The Skill does not specify: - Data provenance validation. - Separation of content from executable behavioral instructions. - Approval before incorporating records into future style rules. - Account-level isolation. - Expiration or deletion controls. - Integrity protection for the memory files. The behavior therefore creates a memory-poisoning path. An attacker does not need to modify the Skill itself if they can influence material t ...[truncated 1294 chars]
Remediation: View remediation

T07 · Tool Hijacking and Spoofing

Error

Location: SKILL.md:266
Finding: Automatic Execution of Mutable Scripts Outside the Audited Skill Boundary
Content: View full analysis
/scripts/style-observe.py record-original \ --skill xiaohongshu-ops --topic "topic keywords" python3 /scripts/style-observe.py record-final \ --skill xiaohongshu-ops ``` ```bash /scripts/generate-image.sh "prompt content" output.jpg /scripts/seedream-generate.sh \ "prompt content" output.jpg "1680x2240" 1 ``` Additional reference-image examples invoke the same external scripts: ```bash /scripts/generate-image.sh "prompt" img-01.jpg /scripts/generate-image.sh "prompt" img-02.jpg --ref img-01.jpg ``` ### Technical Analysis None of the referenced scripts are included in the audited project tree. They reside in a mutable workspace path and may be created or replaced independently of the reviewed Skill artifact. The main Skill states that style observation runs automatically after content production. Consequently, a malicious or compromised `style-observe.py` can execute arbitrary code merely because a normal content task reaches the recording stage. The documented commands also interpolate file placeholders directly into shell command templates. The note-file and final-file placeholders are not quoted. If the surrounding Agent implementation executes the template through a shell, a filename containing shell metacharacters can alter command parsing. The image-generation scripts may also transmit prompts or reference images to external services, but those scripts were unavailable for review. Their authentication, endpoint selection, retention, and data-handling behavior cannot be verified from this artifact. ### Attack Path #### External-script replacement 1. An att ...[truncated 1705 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/xhs-comment-ops.md:18
Finding: Contradictory Safety Rules Permit Authenticated Account Automation and Comment Sending
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: README.md:32
Finding: Installation Instructions Use Mutable and Unverified Supply-Chain Sources
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import

Findings (33)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The activation criteria are overly broad and can capture generic lifestyle writing or social-commerce content even when the user did not request Xiaohongshu-specific help. Overbroad routing increases the chance of invoking the wrong skill, applying the wrong persona, and performing unintended platform-specific workflows or retention behaviors.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The manifest explicitly says image generation itself is out of scope, but the workflow later instructs prompt assembly and image-generation steps. This kind of scope drift is dangerous because it can activate tools or behaviors the user was told would not be used, undermining informed consent and policy boundaries.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The case-study section warns never to automate Xiaohongshu actions, yet the main workflow repeatedly directs browser-based interaction on the platform. This contradiction is risky because it normalizes unsafe automation despite acknowledging prior account warnings and detection risk.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The prompt assembly guidance explicitly instructs the agent to avoid refusing sensitive-person or copyright-related image requests by generating a similar cartoon substitute instead. This is a policy-bypass pattern because it operationalizes evasion of safety and IP restrictions rather than requiring lawful refusal or safer transformation review. In an image-generation workflow, that makes misuse easy and repeatable.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README explicitly promotes automated posting and automatic comment replies for a social-media account, but does not warn users about risks such as unintended publication, account sanctions, platform policy violations, reputational harm, or unsafe autonomous engagement. In this skill context, the behavior is more dangerous because the tool is designed for end-to-end account operation and scaling via multiple agents, which increases the likelihood and blast radius of unauthorized or harmful actions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 75% confidence
Finding: The instruction requires all external copy to follow persona.md, which may impose a fixed linguistic style or locale-specific voice. The file does not indicate that users can opt out or choose a different language/locale, which can violate language-choice policy when applied universally.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The document says the publish flow does not post, but other sections authorize replying, sending comments, and auto-recording after publication. These conflicting operational boundaries can cause an agent to take external actions a user did not expect, especially on a live social account.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The knowledge-base instructions promote persistent cross-session logging of task inputs, outputs, failures, and findings. Without strict minimization and consent, this can accumulate sensitive user data and account information beyond what is needed for the current task.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill instructs automatic recording of original and final user content into a persistent style-learning dataset. This creates a data-retention and secondary-use risk because sensitive drafts, business content, or personal writing may be stored without explicit per-task consent or minimization.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The display name is entirely in Chinese ("小红书自动运营"), which indicates a language-specific presentation in the skill metadata. In this file there is no accompanying indication that the language choice is optional, user-selectable, or justified as a region-specific tool, so it may violate language/locale policy requirements.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The eval prompt and expected output are written to require Xiaohongshu-style Chinese content, and the assertions reinforce that localized style, but there is no indication that the user is offered a language choice or that the locale restriction is explicitly documented as a justified region-specific constraint. Under the policy, forcing a specific language without opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This markdown file uses Chinese exclusively for headings, assertions, and observations, which can constitute a language policy violation when the skill or evaluation output forces a specific language without user opt-in. There is no indication that Chinese is required for a region-specific purpose or that users may choose another language.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The entire skill specification is written in Chinese and targets Chinese platforms such as 小红书 and 腾讯视频, but it does not state that the skill is region-specific or offer any language/locale choice. Under the stated policy, forcing a specific language or locale without opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The entire skill description is written only in Chinese and does not indicate that users may choose another language or that the skill is intentionally limited to a Chinese-only or region-specific audience. Under the policy, a language or locale restriction should be opt-in or clearly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The file’s content, headings, and planned outputs are entirely specified in Chinese, indicating a fixed language/locale expectation. Under the policy rule, forcing a specific language without opt-in or an explicit justified regional scope is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file hard-codes a specific persona, tone, catchphrases, and stylistic constraints for all outputs, without indicating that user preferences should take priority. In a content-generation skill this can override or bias user intent, causing the agent to produce unwanted identity mimicry or platform-specific persuasion patterns even when the user did not explicitly consent to that style.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The entire checklist is written as a prescriptive guide for producing 小红书 content in Chinese and repeatedly mandates specific Chinese stylistic choices, but it does not offer a language choice or state that the skill is limited to Chinese-language users by design. Under the policy, forcing a specific language or locale without opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The entire skill is written as a Chinese-language framework for producing 小红书 titles, with no indication that users may choose another language or locale. The policy explicitly calls for flagging language or locale constraints when the skill forces a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The prompt template explicitly requires output in Chinese ('中文,直接生成不需要解释'). This is a natural-language locale constraint that forces a specific language without any opt-in or alternative, which matches the policy-violation criteria for language or locale restrictions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This template specifies '中文' as a fixed output requirement rather than a default or user-selectable option. Because the file repeats this locale mandate across templates, it creates a policy issue by enforcing one language without user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The structured assembly rules define the language section as mandatory Chinese, including punctuation style tied to Chinese. This is an all-file-type natural-language policy concern because it forces a locale choice globally for generated outputs without documenting user choice or justified regional limitation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The document title and all operating instructions are written exclusively in Chinese and are framed as the default layout system for producing content, with no indication that users may choose another language or locale. Under the policy criteria, forcing a specific language without opt-in can be a natural-language policy violation unless the locale restriction is clearly justified.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This markdown file defines activation-like recommendation logic based on generic keywords such as “方法、技巧、干货、推荐” and “我、经历、故事、感悟,” then instructs the agent to take the first match. Because the trigger scope relies on broad natural-language signals and provides no negative examples or boundaries, ordinary content could be classified into unintended presets.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The file is primarily written in Chinese, but the prescribed fallback prompt is hard-coded in English and instructs users to append that English block to every subsequent prompt. This imposes a specific language choice without any opt-in or justification, which matches the locale/language policy violation criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The entire skill file is written in Chinese and prescribes fixed Chinese UI labels and reply conventions such as 回复 <用户名> without any opt-in or alternative locale support. This creates a natural-language locale constraint that may violate organizational language-choice policy when not explicitly justified as region-specific.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.