redbook

• Outcome: Review
• Latest audit: Jul 4, 2026 · 10:21 PM UTC
• Version: 0.8.1

Overview

This is a real Xiaohongshu automation CLI, but it gets broad access to browser login cookies and can post, reply, upload, and delete content from the user's account.

Install only if you are comfortable giving an agent access to your logged-in Xiaohongshu/RedNote session and live account actions. Prefer a dedicated browser profile or test account, avoid saving cookies unless necessary, clear ~/.redbook/cookies.json after use, review every post/delete/reply command before execution, and be cautious with the npm postinstall behavior that modifies ~/.claude/skills and node_modules.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (32)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 81% confidence
• Finding: The skill declares only local tools, but its documented behavior clearly relies on network access to query Xiaohongshu/RedNote and on environment-backed credential handling. This mismatch weakens review and consent boundaries because users may believe the skill is limited to harmless local processing when it actually performs authenticated remote operations.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The skill includes commands to export and persist reusable login cookies, which are bearer credentials for the user's Xiaohongshu account. Storing and reusing such tokens broadens the blast radius of compromise: anyone or any process with file access can act as the user, and the feature exceeds what is strictly necessary for simple analysis tasks.

Context-Inappropriate Capability

Low

• Confidence: 72% confidence
• Finding: In the rendering/auth sections, the skill mixes an 'offline' feature with guidance to use environment variables and plaintext cookie files for authenticated operations. That coupling can mislead users into exposing credentials in contexts unrelated to rendering, increasing accidental leakage through logs, shell history, or committed dotfiles.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The CLI can extract authenticated browser cookies from local Chrome/Safari/Firefox profiles and reuse them for account actions, but this credential-harvesting/storage behavior is not clearly disclosed in the skill metadata. Because cookies are equivalent to an active session, a user may unknowingly grant the tool access to their Xiaohongshu account and enable persistent authenticated actions.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The client exposes numerous state-changing capabilities—likes, collections, comments, deletion, uploads, and note creation—even though the stated skill purpose is limited to searching, reading, and analyzing content. This expands the blast radius of any agent misuse or prompt-injection-driven invocation from passive data access into authenticated account manipulation and content operations.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The file includes especially sensitive publishing and deletion flows, including deleteNote, uploadFile, getUploadPermit, and createImageNote, which enable irreversible or externally visible account changes. In an agent skill, such capabilities are dangerous because they can be triggered with the user's authenticated cookies and can lead to content loss, unauthorized posting, or account abuse beyond the advertised purpose.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: This code synthesizes extensive browser and device fingerprint attributes, then emits browser-style trace identifiers for a CLI tool whose stated purpose is content search/automation. In context, this is anti-detection and impersonation logic designed to masquerade as a real browser session, which can help bypass platform abuse controls and complicate attribution.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The module encrypts and packages fabricated fingerprint fields into a B1 token specifically to resemble browser-generated anti-bot telemetry. That materially increases the tool's ability to evade detection and access controls, which is dangerous in a scraping/automation skill targeting a third-party service.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The documentation explicitly describes automatic extraction of browser cookies from Chrome profiles but provides no warning, consent requirement, or privacy/security guidance. Browser cookies are authentication material, so normalizing silent access increases the risk of unauthorized account use, accidental over-collection, or unsafe deployment by users who may not realize the sensitivity of the behavior.

Missing User Warnings

Low

• Confidence: 85% confidence
• Finding: The document recommends sending user-provided topics and content to the Gemini API via `GEMINI_API_KEY` but does not mention that prompts, images, or related metadata may be transmitted to a third-party service. In a skill that processes Xiaohongshu content, this can expose user content, account data, or sensitive drafts without explicit operator awareness or consent.

Missing User Warnings

High

• Confidence: 84% confidence
• Finding: The batch-reply flow can send multiple live replies using stored or extracted authenticated cookies, and execution occurs as soon as a template is provided unless the user separately remembers --dry-run. In the context of an automation skill with account-writing capabilities, this raises the risk of accidental spam, account sanctions, or unintended mass actions from a single command.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This code copies Chrome profile material to a temporary directory and extracts decrypted browser cookies without any consent gate or operation-site warning. Even though it later filters for xiaohongshu.com, it accesses highly sensitive authenticated session data and creates additional exposure by duplicating cookie databases and encryption metadata on disk.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The function issues Network.getAllCookies against Chrome DevTools, which retrieves all decrypted browser cookies for the profile, not just the target site. This creates unnecessary access to unrelated authenticated sessions and materially increases the risk of account hijacking or abuse if the data is logged, mishandled, or reused elsewhere.

Missing User Warnings

High

• Confidence: 91% confidence
• Finding: The deleteNote method performs an authenticated destructive action with no built-in confirmation, warning, or friction. In an agent context, that makes accidental invocation, prompt-induced misuse, or malicious orchestration materially more dangerous because deletion can be immediate and irreversible.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The uploadFile method reads arbitrary local files and transmits them to a remote host using authenticated upload permits, without any in-file guardrails or disclosure. In an agent setting, this can enable unintended exfiltration of local data or unauthorized publication workflows if file paths are influenced by untrusted input.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This code enumerates browser profiles and extracts authenticated Xiaohongshu session cookies from local browser stores without any in-function consent gate or explicit user confirmation. Even if intended for user automation, browser cookie harvesting is sensitive credential access because possession of these cookies can allow account/session hijacking if invoked unexpectedly or by a higher-level workflow without clear disclosure.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The CDP fallback launches Chrome headless and reads cookies directly via DevTools Protocol, which is a more invasive credential-access path than normal file-based reads. Without an explicit pre-action warning and confirmation, this creates a high-risk capability that can silently obtain live authenticated session material and bypass some browser encryption protections.

Missing User Warnings

Low

• Confidence: 85% confidence
• Finding: The code performs authenticated /user/me requests using harvested browser cookies to determine which platform the user is logged into. Even though the call is lightweight and functionally related to the tool's purpose, it sends credential-backed requests outbound during detection without an obvious explicit consent or warning at the detection call site, which can surprise users and has privacy implications.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: Cookie values are concatenated into the generated fingerprint payload, causing session-related data to be copied into an opaque anti-detection token. This increases privacy risk and may leak or repurpose sensitive identifiers beyond their original authentication use, especially if logged, transmitted to additional services, or reused across contexts.

Credential Access

High

• Category: Privilege Escalation

Content

- Uses `@steipete/sweet-cookie` to read browser cookies
- Auto-discovers Chrome profiles via `~/Library/Application Support/Google/Chrome/Local State`
- Keychain timeout patched to 30s in node_modules (upstream bug: hardcoded 3s)
- `--chrome-profile` flag available as escape hatch, but auto-discovery handles most cases

• Confidence: 95% confidence
• Finding: Keychain

Credential Access

High

• Category: Privilege Escalation

Content

After installing, run `redbook whoami` to verify the connection. The CLI auto-detects all Chrome profiles to find your XHS session.

- **macOS** — If Keychain prompt appears, click "Always Allow"
- **Windows** — Chrome 127+ uses App-Bound Encryption. The CLI auto-launches Chrome headless to read cookies (close Chrome first). If auto-extraction fails, use `--cookie-string` as fallback

## What You Can Do

• Confidence: 94% confidence
• Finding: Keychain

Credential Access

High

• Category: Privilege Escalation

Content

| `No 'a1' cookie found` | Log into xiaohongshu.com in Chrome, then retry |
| Windows `-101` error | Chrome 127+ App-Bound Encryption. **Close Chrome first**, then re-run (CLI auto-launches Chrome headless to read cookies). If it still fails, use `--cookie-string` |
| Windows `--cookie-string` | Press F12 in Chrome → Application → Cookies → xiaohongshu.com. Copy `a1` and `web_session` values: `redbook whoami --cookie-string "a1=VALUE; web_session=VALUE"` |
| macOS Keychain prompt | Enter your password and click "Always Allow" — the CLI needs to decrypt Chrome's cookies |
| Multiple Chrome profiles | The CLI auto-scans all profiles (macOS / Windows / Linux). To pick one: `--chrome-profile "Profile 1"` |
| Using Brave/Arc/other | Try `--cookie-source safari`, or log into xiaohongshu.com in Chrome |

• Confidence: 95% confidence
• Finding: Keychain

Credential Access

High

• Category: Privilege Escalation

Content

- Node.js >= 22
- Logged into xiaohongshu.com in Chrome (or Safari/Firefox with `--cookie-source`)
- macOS (cookie extraction uses native keychain access)
- **For card rendering only:** `puppeteer-core` and `marked` (`npm install -g puppeteer-core marked`). Uses your existing Chrome — no additional browser download.

• Confidence: 78% confidence
• Finding: keychain

Credential Access

High

• Category: Privilege Escalation

Content

* Extract XHS cookies from browser cookie store.
 *
 * Strategy (for Chrome source):
 *  1. Try sweet-cookie (direct SQLite read + DPAPI/Keychain decrypt)
 *  2. If incomplete (common on Windows with Chrome 127+ App-Bound Encryption),
 *     fall back to CDP — launch Chrome headless and read cookies via DevTools Protocol
 *  3. If both fail, throw with detailed troubleshooting for the user's platform

• Confidence: 97% confidence
• Finding: Keychain

Credential Access

High

• Category: Privilege Escalation

Content

/**
 * Lightweight, non-throwing cookie probe for platform auto-detection.
 * Reads only via sweet-cookie (no CDP fallback, no keychain retries, no logs)
 * for a specific cookie domain (via cookieUrl). Returns null if the required
 * cookies (a1 + web_session) are not present for that domain.
 *

• Confidence: 90% confidence
• Finding: keychain

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: src/lib/cdp-cookies.ts:173