Security audit
Security checks for vulnerabilities and agentic risk
The skill’s Xiaohongshu automation purpose is mostly coherent, but its bundled OpenClaw setup guide asks users to run broad installer and gateway-administration steps that expose credentials and persistent access.
Review before installing. The Xiaohongshu workflow includes useful safeguards such as stopping before publish and requiring confirmation before replies, but the included OpenClaw one-click setup guide should not be pasted blindly. Avoid curl-to-bash installers, do not print or share gateway tokens, verify device identities before approving them, and consider whether persistent browser and gateway access is appropriate for the account you plan to automate.
Openclaw一键安装.md:37Remote Installation Script Executed Without Integrity Verification
Openclaw一键安装.md:89Installer Creates and Starts a Persistent Gateway Service by Default
Openclaw一键安装.md:58Unpinned Global npm Package Installation
Openclaw一键安装.md:97Gateway Authentication Token Printed to Terminal Output
Openclaw一键安装.md:156Latest Pending Device Is Approved Without Identity Verification
The entire file is an OpenClaw installation and administration guide, which is materially different from the declared skill purpose of Xiaohongshu operations. This capability drift is dangerous because it introduces local environment bootstrap, authentication, and gateway management behavior that a user would not reasonably expect from the manifest, increasing the chance of unreviewed privileged actions.
Using curl ... | bash chains untrusted network content directly into code execution, removing any meaningful inspection boundary. In a skill that is unrelated to system administration, this pattern is especially dangerous because it can silently bootstrap arbitrary code on the host under the guise of a content-operations workflow.
fi
echo "[1/6] 安装 nvm..."
curl -fsSL https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.0/install.sh | bash
# shellcheck disable=SC1090
. "$NVM_DIR/nvm.sh"
}
The script retrieves the gateway authentication token from local config and prints it directly to the terminal. This unnecessarily exposes a sensitive bearer credential that can be copied from shell history, logs, screen recordings, shared terminals, or shoulder-surfing, and it is unrelated to the stated Xiaohongshu operations purpose of the skill.
Printing the gateway authentication token to the terminal creates immediate credential exposure. Any process or person with access to terminal logs, recordings, support transcripts, or shared sessions could reuse the token to access the gateway, making this especially risky in a setup script.
The file includes local environment setup, package installation, onboarding, and service management for OpenClaw, none of which are justified by the advertised Xiaohongshu content operations use case. In this context, the mismatch makes the instructions more dangerous because users may execute infrastructure-changing steps without expecting system-level effects.
The guide exposes the gateway token in plain text and does not warn that it is a sensitive secret. Users are therefore more likely to paste it into chats, store it in insecure notes, or leave it visible in terminal scrollback, enabling unauthorized access to the local gateway.
The documentation instructs users to extract the auth token from config into an environment variable for reuse. Even though this is common operationally, documenting direct token handling without safeguards increases the risk of exposure through shell history, process listings in some contexts, copied snippets, and accidental sharing.
The documentation explicitly promotes fully automated publishing and automated comment interaction, which are account- and platform-impacting actions, but provides no warning, approval checkpoint, rate-limit guidance, or policy/compliance caveat. In an automation skill for social-platform operations, this increases the risk of spammy behavior, unauthorized posting, account sanctions, and reputational damage if the automation misfires or is misused.
The README explicitly promotes automated posting, automated comment replies, and account operation via browser automation, but it does not warn users about platform policy violations, account suspension/rate limiting, or the privacy/security implications of persistent login sessions and handling comment/content data. In the context of a skill designed to autonomously operate a social media account, that omission materially increases the chance that users deploy it unsafely or in violation of platform rules.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## Star 趋势
[](https://star-history.com/#Xiangyu-CAS/xiaohongshu-ops-skill&Date)
The skill explicitly requires all external copy to follow a local persona/style file, which can override a user's preferred tone, language, or communication constraints without opt-in. While not directly enabling code execution or data theft, it can cause the agent to ignore user intent and produce manipulative or misaligned outputs, especially in a publishing/engagement workflow.
The file explicitly defines the persona and output style for Xiaohongshu-specific Chinese posting and reply behavior, including platform-specific tone and phrasing. This imposes a specific language/locale expectation without any opt-in, fallback, or explanation that the skill is restricted to a region-specific use case.
The script fetches and executes a remote installer from GitHub in one step, which creates a supply-chain and integrity risk. If the remote content, transport, repository, or referenced version were compromised, arbitrary code would execute on the user's machine during setup.
fi
echo "[1/6] 安装 nvm..."
curl -fsSL https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.0/install.sh | bash
# shellcheck disable=SC1090
. "$NVM_DIR/nvm.sh"
}
The file presents the skill name and all user-facing documentation in Chinese, which can amount to a language-policy issue when no opt-in or locale justification is provided. The content does not indicate that the skill is restricted to Chinese-speaking users or that an alternative language is available.
This markdown file presents the skill template and usage guidance entirely in Chinese, which can impose a fixed language/locale on users. The policy allows locale constraints when users are given a choice or when the constraint is clearly documented and justified, neither of which appears here.
No suspicious patterns detected.