Security audit

Xhs Auto Publish

Security checks for vulnerabilities and agentic risk

Overview

This skill is built to automate Xiaohongshu posting, but it needs Review because it can publish public posts without a final user approval step.

Install only if you intentionally want an agent to publish to a logged-in Xiaohongshu account. Review or modify it to add a preview-and-confirm step before publishing, avoid cron until you trust the generated content, and confirm which account the xhs integration will use.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The README promotes automatic content generation, publishing, and cron-based scheduled posting to an external platform, but it does not clearly warn that the skill can perform real account actions and change external platform state. This can mislead users into invoking it without understanding that posts may be created or published automatically, increasing the risk of unintended account activity, spam, or reputational damage.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The skill explicitly instructs the agent to generate content and publish it directly without per-post user confirmation. Because this action can post to the user's authenticated Xiaohongshu account, it creates a high-risk unauthorized-action path: mistaken activation, prompt injection, or misunderstood user intent could cause irreversible external side effects and reputational harm.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The README promotes automated generation and publishing to a live Xiaohongshu account, including scheduled execution, but does not present a prominent warning that the skill can perform account-impacting external actions. This increases the chance that a user or agent invokes it without informed consent, leading to unintended posts, account misuse, reputational damage, or platform enforcement actions.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The script explicitly instructs the downstream agent to publish content directly without any user confirmation, removing a human approval checkpoint before an external side effect occurs. Because the prompt may be built from external input or auto-selected topics, this increases the chance of unintended, low-quality, off-brand, or policy-violating posts being published automatically.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The installer unconditionally creates a workspace scripts directory, copies an executable shell script into it, and marks it executable without prompting the user or requiring explicit consent. In a skill package, this is risky because it modifies files outside the skill directory and establishes an executable entrypoint in the user's workspace, which could facilitate persistence or unexpected execution if the referenced script is later found to be unsafe.

Static analysis

No suspicious patterns detected.