post-to-xhs

• Outcome: Pass
• Latest audit: May 28, 2026 at 9:55 AM UTC
• Version:
  1.0.1

Overview

This is a disclosed Xiaohongshu account automation guide, but installing it means trusting an external CLI that can post and interact from your account.

Install only if you trust the external xhs-mcp-py package and are comfortable authorizing account automation. Review every post, comment, like, favorite, and reply before allowing it to run, and use logout when finished to remove stored Xiaohongshu cookies.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The skill description is extremely broad, covering essentially any Xiaohongshu-related action, which increases the chance of the skill being invoked for ordinary conversational requests without sufficient user confirmation. Because this skill can log in, publish content, and perform interactions on a real account, overbroad triggering raises the risk of unintended account actions.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The markdown documents multiple state-changing operations—publishing posts, liking, favoriting, commenting, replying, and logging in—without an explicit warning that these actions will modify the user's Xiaohongshu account and may create public or semi-public activity. In this context, the omission is dangerous because the skill is specifically designed to act on a live social-media account, so users may not realize that invoking it can immediately publish content or perform visible interactions.

VirusTotal

66/66 vendors flagged this skill as clean.