ClawHub
Back to skill

Security audit

xhs-auto

Security checks for vulnerabilities and agentic risk

Overview

This Xiaohongshu publishing skill is mostly purpose-aligned, but it uses account-publishing tools and credential-bearing image API calls with weak scoping and dependency controls.

Install only if you are comfortable giving xhs-kit access to your Xiaohongshu publishing workflow and sending prompts or selected images to configured image providers or gateways. Use a virtual environment, pin and review dependency versions, prefer official HTTPS API endpoints, avoid sensitive images or draft content, use restricted API keys, and review generated content before any formal publish command.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/xhs-image.py:49
Finding

Custom API endpoints can receive provider credentials and user-supplied images

Content
View full analysis
bytes: """文生图""" url = f"{self.api_base.rstrip('/')}/v1/images/generations" payload = { "model": self.model, "prompt": prompt, "size": self.size, "n": 1, "response_format": "b64_json" } if seed is not None: payload["seed"] = seed headers = { "Authorization": f"Bearer {self.api_key}", "Content-Type": "application/json" } log_info(f"Generating image via {self.provider} ({self.model}) size {self.size}") try: response = requests.post(url, json=payload, headers=headers, timeout=120) response.raise_for_status() def edit(self, prompt: str, base_image_path: str, ...[truncated 5886 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:30
Finding

Security-sensitive third-party tools are installed without version or integrity pinning

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

This mismatch becomes security-relevant because the skill presents itself as a publishing workflow while also implying external network access to image-generation services and local file writes without prominently declaring them as side effects. Users may consent to drafting content but not realize the skill can transmit prompts/content externally and persist outputs locally, which weakens informed consent and increases privacy risk.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

This mismatch becomes security-relevant because the skill presents itself as a publishing workflow while also implying external network access to image-generation services and local file writes without prominently declaring them as side effects. Users may consent to drafting content but not realize the skill can transmit prompts/content externally and persist outputs locally, which weakens informed consent and increases privacy risk.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill declares shell, network, and environment-dependent behavior via required binaries and documented commands, but it does not define any explicit tool scope such as allowed-tools or permissions. That creates an unnecessary trust gap: an agent may invoke broader capabilities than users expect, including network submission and filesystem writes, without a clear least-privilege contract.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

The skill description and instructions are entirely framed around Chinese-language Xiaohongshu post creation, including example triggers and content-writing requirements, but they do not state that this is a region-specific skill or give users an opt-in language choice. Under the policy, forcing a specific language or locale without user choice can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

Using xhs-kit debug-publish sends user-generated content and possibly image references to a remote validation endpoint, yet the skill does not clearly warn users before that transmission occurs. This can expose unpublished content, personal data, or regulated material to third-party systems and may also let remote responses influence subsequent workflow decisions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly describes sending prompts and, in edit mode, user-supplied base images to external third-party APIs, but it does not clearly warn users about that data transfer at the point where the capability is introduced. This creates a privacy and data-handling risk because users may provide sensitive text or images without realizing they will leave the local environment and be processed by external providers or proxy gateways.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/text-to-image.md (reported line 81)May include surrounding context.

md
安装示例：
- **macOS**：`brew install curl jq coreutils`
- **Ubuntu / Debian**：`sudo apt-get install curl jq coreutils`
- **CentOS / Rocky / Alma**：`sudo yum install curl jq coreutils`
- **Windows**：需要 Git Bash 或 WSL 环境

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/text-to-image.md (reported line 82)May include surrounding context.

md
安装示例：
- **macOS**：`brew install curl jq coreutils`
- **Ubuntu / Debian**：`sudo apt-get install curl jq coreutils`
- **CentOS / Rocky / Alma**：`sudo yum install curl jq coreutils`
- **Windows**：需要 Git Bash 或 WSL 环境

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/xhs-image.py (reported line 91)May include surrounding context.

python
log_info(f"Generating image via {self.provider} ({self.model}) size {self.size}")
        
        try:
            response = requests.post(url, json=payload, headers=headers, timeout=120)
            response.raise_for_status()
            
            result = response.json()

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/xhs-image.sh (reported line 148)May include surrounding context.

sh
'{model: $model, prompt: $prompt, size: $size, n: 1} | if $seed != "" then .seed = ($seed|tonumber) else . end')

  local response
  response=$(curl -sS -X POST "${ENDPOINT_BASE}/v1/images/generations" \
    -H "Authorization: Bearer ${API_KEY}" \
    -H "Content-Type: application/json" \
    -d "$payload") || {

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The skill notes where outputs are stored, but it does not present this as a clear up-front warning about persistent local writes. Users may provide sensitive topics, draft copy, or private images without realizing the resulting content and metadata will be saved under the workspace, increasing confidentiality and cleanup risks.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.