Security audit

小红书长文-谷歌浏览器

Security checks for vulnerabilities and agentic risk

Overview

The skill is not clearly malicious, but it needs Review because it can publish live Xiaohongshu content through a shared logged-in browser profile and automatic desktop-level clicks.

Install only if you intentionally want an agent to publish to a real Xiaohongshu account. Use a dedicated Chrome profile or account instead of the shared Zhihu profile, run without --submit for review/dry-run first, disable screen clicking with XHS_DISABLE_SCREEN_CLICK=1 unless you need it, and verify browser permissions and screenshots after use.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The script explicitly uses a shared browser profile named for Zhihu and instructs the user to log into both Zhihu and Xiaohongshu, despite the skill being scoped to Xiaohongshu publishing. Sharing one persistent Chrome profile across unrelated services expands the blast radius of any automation mistake or profile compromise, enabling unintended access to another logged-in account.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The file contains multiple Zhihu-specific references in comments, profile paths, prompts, and log names while the declared skill is for Xiaohongshu. This mismatch is a security-relevant design flaw because it signals copy-pasted cross-service automation and increases the chance the operator runs the wrong workflow against the wrong authenticated profile or exposes credentials/session state across services.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The script includes pyautogui-based OS-level clicking that can control the desktop outside the attached Chrome tab. That exceeds the stated browser-attach publishing scope and creates a broader automation primitive that could misclick other apps, approve unexpected prompts, or interact with unrelated windows if focus changes under VNC/X11.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The code programmatically changes browser site permissions for geolocation and notifications using CDP, which is unrelated to composing and publishing content. Altering persistent browser permissions can affect user privacy and browser state beyond this single action, and may suppress prompts the user would otherwise review manually.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The README explicitly documents a non-interactive publishing flow using `--publish` and `--submit` against a real Xiaohongshu account, but it provides no warning that the command will create or submit external content. In the context of a browser-attach automation skill that shares a live Chrome profile, this omission increases the risk of unintended posts, accidental account actions, and misuse by downstream agents or users who may treat the command as harmless content generation rather than live account automation.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The trigger list includes broad phrases such as '发小红书' and '发布到小红书' without clear constraints like requiring explicit user confirmation, target platform disambiguation, or draft-vs-publish intent. In a skill that can perform a real post using an existing logged-in Chrome session, broad activation language increases the risk of accidental invocation and unintended publication.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: OS-level automated clicks are performed as an internal fallback with only incidental log messages, not a strong user-facing warning at the moment of execution. Because pyautogui acts on screen coordinates rather than DOM elements, a shifted window, popup, or focus change could cause unintended interactions such as approving dialogs or clicking sensitive UI outside the target page.

Static analysis

No suspicious patterns detected.