Xiaohongshu Hot Daily

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:40 AM UTC
• Version: 3.1.0

Overview

The skill appears to fetch public Xiaohongshu trend data as advertised, but its install path uses mutable global tooling and an unpinned browser runtime that users should review before installing.

Install only if you are comfortable running unpinned npm-based tooling and a browser automation runtime globally. Prefer using pinned package versions in an isolated environment, and treat fallback reports cautiously because simulated data may not be clearly labeled in saved output.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:31

Finding

Unpinned Third-Party Packages and Browser Runtime Installation

Content

View full analysis

Remediation

View remediation

clawhub install xiaohongshu-hot-daily npm install --save-exact agent-browser@ ``` 2. Install dependencies locally within the project rather than globally, and invoke them through a package script or a version-pinned `npx` command. 3. Commit a lockfile with dependency integrity hashes and use a reproducible installation command such as: ```bash npm ci --ignore-scripts ``` If lifecycle scripts are required, review them first and enable only the necessary installation step explicitly. 4. Pin and verify the Chromium runtime version. Where supported, validate the downloaded artifact using a publisher signature or a documented SHA-256 checksum. 5. Document the expected registry and official package publisher so users can verify package provenance before installation. 6. Run installation and browser automation as an unprivileged user in an isolated environment or container. Do not use administrative privileges for global installation. 7. Add automated dependency monitoring and repeat the security review before updating any pinned package or browser runtime. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The skill description overstates capabilities by promising 'real data,' scheduled-task support, and broader analysis while also disclosing fallback simulated data and lacking implemented scheduling logic in this file. This mismatch can mislead users about network behavior, data authenticity, and operational expectations, which is risky for an automation skill that scrapes external content and saves reports.

Content

No source excerpt is available for this finding.

os.system() or os exec-family call

High

• Category: Dangerous Code Execution
• Confidence: 85% confidence

Finding

os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.

Content

Scanner excerpt · fetch_hot.py (reported line 19)May include surrounding context.

python

# 设置控制台编码
if sys.platform == 'win32':
    os.system('chcp 65001 >nul 2>&1')
    sys.stdout.reconfigure(encoding='utf-8')
    sys.stderr.reconfigure(encoding='utf-8')

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The install command uses npx clawhub@latest, which fetches and executes the newest published package version at runtime rather than a reviewed, pinned release. If the upstream package is compromised, typosquatted, or a malicious update is published, users following the README could execute attacker-controlled code on their system.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill advertises or implies shell execution and file-writing behavior but does not declare any explicit tool scope such as permissions or allowed-tools. In an agent environment, this weakens least-privilege controls and can allow broader execution and filesystem effects than a user may reasonably expect from the manifest alone.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

Using 'npx clawhub@latest' pulls and executes code at install time without a pinned version, making the installation non-reproducible and exposing users to upstream compromise or malicious package updates. This is a classic supply-chain risk because the trust boundary includes whatever version is current at execution time.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill encourages scheduled scraping and saving of collected Xiaohongshu data but does not prominently warn that recurring runs will generate ongoing network traffic and local data accumulation. In an agent context, silent persistence and repeated external access can create privacy, storage, and policy-compliance issues, especially if users enable cron-like execution and forget it is active.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · fetch_hot.py (reported line 61)May include surrounding context.

python

# 使用 agent-browser 获取数据
        try:
            # 打开页面
            subprocess.run(
                ['agent-browser', 'open', self.url],
                capture_output=True,
                text=True,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · fetch_hot.py (reported line 69)May include surrounding context.

python

)
            
            # 等待页面加载
            subprocess.run(
                ['agent-browser', 'wait', '2000'],
                capture_output=True,
                text=True,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · fetch_hot.py (reported line 77)May include surrounding context.

python

)
            
            # 执行 JS 获取数据
            result = subprocess.run(
                ['agent-browser', 'eval', js_code, '--json'],
                capture_output=True,
                text=True,

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

When live fetching fails, the code silently returns hardcoded simulated hot-list entries while presenting them as normal results. In a data/reporting skill, this can mislead downstream automation or users into trusting fabricated output as real-time platform data, creating integrity and decision-making risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The summary field is explicitly written in Chinese (e.g. '今日小红书热榜摘要') and presents the content in a fixed locale with no indication that users can choose another language. Under the policy, forcing a specific language without opt-in is a natural-language locale violation unless clearly documented as region-specific and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The entire skill description is written in Chinese and presents the skill as Chinese-only, with no indication that users may choose another language or locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The description and author-facing metadata are presented exclusively in Chinese, and the file does not indicate that the skill is region-specific or that users can opt into this locale. Under the policy, forcing a specific language without opt-in can be a natural-language policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.