Security audit

Xhs Expert

Security checks for vulnerabilities and agentic risk

Overview

This skill is a real Xiaohongshu automation tool, but it can act through a logged-in account, store session cookies, and use stealth browser automation without enough enforced safeguards.

Install only if you intentionally want automation that can operate a Xiaohongshu account. Use a separate account/profile, protect or regularly delete ~/.config/xiaohongshu, manually confirm every comment, follow, and batch action, and understand that stealth automation or bulk engagement may violate platform rules or risk account enforcement.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (16)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill advertises and orchestrates file access, local state persistence, and networked automation, but it does not declare corresponding permissions. That creates a transparency and containment failure: a user or host system cannot accurately assess or restrict what the skill may access, while the documented cookie persistence and CLI/network behavior imply meaningful access to local auth material and external services.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The documented behavior goes beyond ordinary Xiaohongshu operations into anti-detection and browser-control territory: remote-debug Chrome/CDP access, stealth injection, browser fingerprint evasion, and persistent cookie synchronization. Those capabilities materially increase risk because they can expose browser session data, interact with an already-authenticated browser context, and conceal automation in ways not clearly disclosed by the top-level purpose.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The code deliberately injects anti-detection logic that hides browser automation indicators, spoofs fingerprinting surfaces such as navigator.webdriver, plugins, and languages, and removes known automation artifacts. In the context of a skill explicitly designed for bulk XHS operations and account interaction, this materially increases the capability to evade platform defenses and enables large-scale deceptive automation rather than legitimate browser control.

Intent-Code Divergence

Medium

Confidence: 89% confidence
Finding: The header comments describe the launcher as supporting 'Stealth注入' in a normalized way, while the implementation performs concrete automation-detection bypass actions. This mismatch is dangerous because it obscures the true risk profile of the component, making review, approval, and downstream use more likely without adequate controls in a skill intended for mass account operations.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The signing helper is explicitly framed as a simplified stand-in for a reverse-engineered platform signature, and the docstring recommends browser injection or Selenium to obtain 'real' signatures. In the context of a skill designed for bulk Xiaohongshu search and interaction, this materially enables bypass of normal client controls and supports unauthorized automated access to platform endpoints.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The trigger phrases are broad enough to activate on ordinary requests about Xiaohongshu, including benign analysis or search queries, yet the skill can perform account-impacting actions such as likes, comments, follows, and batch operations. Overbroad routing raises the chance of unexpected invocation of a powerful automation skill, especially in mixed-language or loosely phrased conversations.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill explicitly mentions cookie persistence and login/session handling but does not provide a clear warning that authentication material will be stored locally and reused. Stored cookies and synchronized login state are sensitive credentials in practice; if mishandled or accessed by other processes, they can enable account takeover or unauthorized actions without the user's awareness.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill documents automated likes, comments, follows, and batch interactions without a general upfront warning that these are account-impacting operations that may be irreversible, rate-limited, or violate platform rules. Even though some confirmations are described later, the absence of a broad risk notice reduces informed consent and increases the likelihood of unintended social or account consequences.

Natural-Language Policy Violations

Medium

Confidence: 83% confidence
Finding: The stealth script forcibly overrides browser language preferences to Chinese without user choice, altering fingerprinting and locale behavior in a deceptive way. In this XHS-focused automation skill, that helps make automated traffic appear regionally consistent, which can aid impersonation, evade fraud heuristics, and cause privacy or consent issues for users operating outside that locale.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The `interact comment` command directly posts user-supplied content to an external platform using the authenticated account with no confirmation, dry-run, or explicit warning that this is a live account action. In an agent skill focused on bulk platform operations, this increases the risk of unintended posting, prompt-injection-driven misuse, or accidental spam from a real user account.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The follow/unfollow command changes account relationships on the external service immediately after invocation, without any user warning or confirmation. Because this skill is explicitly designed for social-media operation and batch interaction, silent execution of relationship-changing actions raises the chance of unauthorized or unintended account manipulation.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: This code persists live authentication cookies to a predictable file under the user's home directory in plaintext JSON, with no encryption, permission hardening, expiry enforcement, or user-facing warning. In the context of a tool that automates Xiaohongshu account operations and supports multi-account switching, theft of this file could allow session hijacking and unauthorized actions on behalf of the user.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The code persists collected Xiaohongshu data to a predictable local path under the user's home directory without any disclosure, consent flow, retention control, or permission hardening. In a skill explicitly designed for large-scale collection and account operations, silent storage increases privacy and compliance risk because scraped content may accumulate on disk and be accessed later by other local users, processes, or backup systems.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The batch_like, batch_collect, and batch_comment methods enable repeated external actions against a third-party platform with only a fixed sleep delay and no user confirmation, consent checkpoint, per-run limit, or abuse-prevention controls. In the context of an XHS bulk-operations skill, this materially increases the risk of automating spammy engagement, violating platform rules, or causing account bans and unintended mass interactions.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The parser explicitly exposes an xsec-token extracted from embedded page state, which is a sensitive request/authentication-related token. In the context of a skill designed for bulk scraping and interaction on Xiaohongshu, surfacing this token creates a clear path for downstream unauthorized API use, session abuse, or replay of privileged requests without any guardrails, minimization, or user disclosure.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The code persists cookies, signing headers, device identifiers, and credential-like tokens to a predictable plaintext file under the user's home directory with no encryption, permission hardening, or user warning. If the host is shared or compromised, these artifacts can be stolen and reused to hijack the user's Xiaohongshu session and perform actions as that account.

Static analysis

No suspicious patterns detected.