Security audit

Xhs Auto Publish

Security checks for vulnerabilities and agentic risk

Overview

The skill is an automated Xiaohongshu publisher that is mostly disclosed, but it can post to a live account without a review step and can be run unattended.

Review carefully before installing. Use it only with an account where automated public posting is acceptable, avoid cron until you have tested it, and prefer adding a draft/preview and explicit approval step before any publish action. Do not pass untrusted or instruction-like text as the topic.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Warning

Location: references/xhs-auto-publish-v2.sh:54
Finding: Mandatory Promotional Content Injection and Unreviewed Publication
Content: View full analysis
" else prompt="" fi ``` The angle-bracketed text above is an English rendering of the original Chinese prompt literals; the variable interpolation and execution logic are unchanged. ### Technical Analysis The skill imposes fixed promotional hashtags on every generated post rather than deriving tags solely from the user's requested subject. In manual mode, the same mandatory promotional content is applied even when the supplied topic is unrelated. The skill also instructs the agent to publish immediately without presenting the final title, body, cover, and tags to the user. This changes the agent's normal content-generation goal into a predefined promotional publication workflow and removes the approval boundary before an external side effect. The behavior is disclosed in the documentation, but it remains securit ...[truncated 1084 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/xhs-auto-publish-v2.sh:48
Finding: User-Controlled Topic Is Embedded in a Privileged Agent Prompt
Content: View full analysis
" else prompt="" fi echo "$prompt" } main() { local auto_mode=false local topic="" while [[ $# -gt 0 ]]; do case $1 in -a|--auto) auto_mode=true shift ;; -h|--help) show_help exit 0 ;; -*) echo "Unknown option: $1" show_help exit 1 ;; *) if [ -z "$topic" ]; then topic="$1" else topic="$topic $1" fi shift ;; esac done local prompt if [ "$auto_mode" = true ]; then prompt=$(build_prompt "auto" "") else prompt=$(build_prompt "manual" "$topic") fi local running_count running_count=$(ps aux | grep -E "openclaw.*agent.*xhs-auto-publish" | grep -v grep | wc -l) if [ "$running_count" -gt 0 ]; then exit 1 fi openclaw agent --message "$prompt" --agent main } ``` The angle-bracketed strings are English renderings of the original prompt literals. The vulnerable interpolation, argument handling, process check, and agent invocation reflect the a ...[truncated 2831 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill explicitly instructs the agent to generate content and publish it directly without requiring item-by-item user confirmation. Because this action posts to the user's social media account, it can cause unauthorized or mistaken publication, reputational damage, and unintended disclosure if the generated content is inaccurate, unsafe, or not approved by the user. The surrounding context makes this more dangerous because the skill is designed for automated account actions and even emphasizes one-shot publishing.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The changelog states 'Mandatory hashtags' followed by fixed Chinese-language tags, which suggests the skill enforces a specific language/locale convention. Under the policy rules, forcing a specific language without user opt-in or clear justified regional scope is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README promotes automatic generation and one-click publishing to a live social-media account but does not warn users that this can trigger real public posts without human review. In the context of a posting skill, omission of review/confirmation safeguards increases the chance of accidental publication, reputational harm, or policy-violating content being posted from a user's authenticated account.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The cron examples instruct unattended scheduled execution of the publishing script without warning that posts may be generated and published automatically while the user is absent. This is dangerous because scheduled runs can amplify mistakes, produce unwanted or noncompliant posts repeatedly over time, and act through an already logged-in account without timely human intervention.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The documentation states that covers must use the Chinese font Noto-Sans-CJK-SC-Bold and forbids common alternative fonts. This is a language/locale-specific constraint presented as mandatory, with no user opt-in or explanation that the skill is limited to a Chinese-language or region-specific context.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README clearly presents the skill as an automated tool for generating and publishing Xiaohongshu posts, but it does not prominently warn that running it will affect a live social-media account. This can mislead users into invoking the skill without understanding that it performs external side effects, increasing the risk of accidental posting, account abuse, or policy violations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The auto-topic mode combines trend discovery, content generation, and live posting without a warning about data provenance, unintended content selection, or autonomous account activity. In this context, the lack of safeguards is more dangerous because the feature can select topics the user did not review and publish them directly to a public account.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The cron examples encourage unattended recurring execution of a script that posts to a live account, but the README does not warn that this enables autonomous repeated publishing. This raises the risk of spam, accidental repeated posts, account suspension, and reputational damage if content is generated or scheduled incorrectly.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script explicitly instructs the downstream agent to 'directly publish without confirmation' and then invokes the agent with that prompt. This removes a human approval checkpoint before an external side effect, increasing the risk of unintended, policy-violating, or attacker-influenced content being posted if the topic or generated content is unsafe.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The natural-language instruction says the cover must use a specific Chinese font and forbids alternative fonts, which effectively imposes a locale/language constraint. Under SQP-3, forcing a specific language or locale without user opt-in can be a policy violation unless it is explicitly justified as region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The generated prompt requires use of a Chinese CJK font and explicitly disallows Western fonts, which encodes a fixed language/locale preference into the skill behavior. Because the script does not offer users a choice or explain a necessary regional limitation, this matches the policy concern described in SQP-3.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.