rednote(xiaohongshu,xhs)

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:42 AM UTC
• Version: 1.0.0

Overview

The skill is mostly coherent, but it saves a Xiaohongshu login session and can perform public account actions without strong per-action safeguards.

Install only if you are comfortable letting an agent use your Xiaohongshu account. Treat rednote_cookies.json like a password, keep it out of shared folders and source control, and review every like, comment, follow, collect, or publish action before running it. Prefer adding URL allowlisting, a dry-run/confirmation step, and protected cookie storage before using this with a real account.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/collect_note.py:11

Finding

Unrestricted Navigation in an Authenticated Browser Context

Content

View full analysis

Remediation

View remediation

str: parsed = urlparse(value) if parsed.scheme != "https": raise ValueError("Only HTTPS URLs are permitted") if parsed.hostname != "www.xiaohongshu.com": raise ValueError("Only approved Xiaohongshu URLs are permitted") if not parsed.path.startswith("/explore/"): raise ValueError("Unsupported Xiaohongshu path") if parsed.username or parsed.password or parsed.port not in (None, 443): raise ValueError("Credentials and unexpected ports are prohibited") return value ``` ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/manual_login.py:8

Finding

Authentication State Stored in a Predictable Plaintext File Without Enforced Permissions

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: SKILL.md:15

Finding

Unpinned Playwright Package and Browser Artifact Installation

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (24)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The supplied code chunk has a much narrower scope than the declared description. It does implement one declared aspect: extracting content from a specific note and formatting it as markdown. However, it does not perform keyword search, nor any engagement actions like liking, commenting, collecting, following, or publishing. Its primary behavior is limited to note-content extraction from a given URL using an authenticated browser session. This is a material description-to-behavior mismatch due to significant overstatement of capabilities.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description presents a full-featured Xiaohongshu interaction tool focused on searching content, extracting notes, and performing social actions. The supplied code does none of those things. Its actual purpose is narrowly to facilitate manual login and persist authentication cookies/storage state in a file. That is a materially different primary purpose and an undeclared capability related to authentication/session capture. While cookie saving could support later platform interactions, this chunk itself is not implementing the described search/extract/engagement features, so the description does not accurately represent the behavior of this code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

There is a clear description-to-behavior mismatch. The declared description presents a broad, comprehensive Rednote tool with search, content extraction, and multiple engagement actions. The supplied code chunk implements only one narrow capability: publishing a post. It opens Xiaohongshu in a Chromium browser, relies on a local storage_state cookie file for authentication, navigates to the creator service page, fills in the note title/content/tags, uploads files, and publishes. None of the other declared capabilities appear in this code chunk. While publishing is included in the declared description, the description materially overstates the implemented functionality of this chunk, and the use of stored cookies/browser automation is an undeclared operational behavior.

Content

No source excerpt is available for this finding.

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 238)May include surrounding context.

explore/note2"

6. Engage with community

python scripts/comment_note.py "https://www.xiaohongshu.com/explore/note3" "Awesome tutorial!"

7. Follow good content creators

python scripts/follow_user.py "https://www.xiaohongshu.com/explore/note-by-creator"

text

## Implementation Guidelines

### Best Practices

1. **Validate Login First**: Login status will be automatically checked using `validate_cookies.py` before performing any interactions to ensure smooth operations.

2. **Rate Limiting**: To avoid account restrictions, implement appropriate delays between consecutive interactions. Avoid excessive rapid interactions.

3. **Error Handling**: Check the return values from the functions to ensure operations were successful before proceeding to the next action.

4. **User Intent**: Only engage with content that matches user interest and preferences. The skill should complement user decisions.

5. **Browser State Management**: The scripts manage browser opening and closing, so ensure sys

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 84% confidence

Finding

The skill instructs the system to automatically trigger a manual-login workflow when authentication validation fails, introducing autonomous browser-based state changes involving user credentials and session capture. In an agent setting, this can lead to unintended authentication flows, coercive prompting, or unsafe handling of session material without an explicit per-action user approval boundary.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

If the output is True, you have normal access and can proceed with search operations.

If the output is False or the login button is visible, the system will automatically execute the manual login procedure:

text

python scripts/manual_login.py

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 83% confidence

Finding

This repeats the same autonomous behavior in troubleshooting guidance: the system may automatically execute the login script and save cookies. Normalizing automatic re-authentication increases the chance of unreviewed credential handling and persistent session creation, which is risky in multi-tenant or agentic environments.

Content

Scanner excerpt · SKILL.md (reported line 297)May include surrounding context.

md

#### Login Error (`❌ 未找到 cookies 文件，请先登录小红书并保存 cookies`)
**Cause**: The `rednote_cookies.json` file doesn't exist or is not in the correct location.
**Solution**: The system will automatically execute `python scripts/manual_login.py` to perform manual login and save cookies. The user just needs to complete the login process in the opened browser window.

#### Login Session Expired (`❌ 未登录小红书，请先登录`)
**Cause**: Authentication tokens have expired or are invalid.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script silently loads persisted authentication state from rednote_cookies.json and then performs an account action (collecting a note) without any user-facing disclosure, consent check, or account-scope validation. In the context of a social-media automation skill that can like, comment, follow, collect, and publish, this increases the risk of unintended actions being executed under a user's logged-in account if the script is triggered with attacker-controlled input or by an unaware operator.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script performs a state-changing public action by submitting a comment immediately after filling the textarea, with no explicit confirmation, preview, or user acknowledgement step. In an agent skill context, this increases the risk of unintended public posting, spam, reputational harm, or abuse if the tool is invoked with attacker-controlled input or on the wrong note URL.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script loads persisted authenticated cookies from a local storage state file and then uses that session to access note data tied to a logged-in account, but it provides no user-facing notice, consent step, or scope limitation around credential use. In a skill explicitly designed to interact with Xiaohongshu content, this makes privacy and account-context data access more dangerous because the code silently reuses authentication material and could expose account-associated content or bypass expected user awareness.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The script loads authenticated session state from rednote_cookies.json and then uses it to perform account actions, but gives no explicit warning that it is accessing and acting under a stored logged-in session. This is dangerous because stored cookies are effectively credentials; if the skill is triggered unexpectedly or the cookie file is reused across contexts, actions may be performed under the user's account without informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script performs an authenticated follow action immediately by clicking the platform's '关注' button, with no explicit user confirmation, dry-run mode, or safeguard against accidental execution. In a skill designed to automate social-platform interactions, this can cause unintended account actions, abuse of the user's identity/session, and potential violation of platform rules if invoked unexpectedly or chained from higher-level agent behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script performs a state-changing action on the user's authenticated Xiaohongshu account immediately after loading the supplied URL, with no confirmation, allowlist, or verification that the target note is the one the user intended. In an agent setting, a prompt or chained tool invocation could cause unwanted likes on arbitrary content, creating account misuse, reputational harm, or policy violations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script saves authenticated browser session state to a local JSON file, which can include cookies and other credentials that allow account reuse without re-authentication. In the context of a skill designed to interact with Xiaohongshu actions like posting, liking, commenting, and following, compromise of this file could enable full account hijacking and unauthorized actions.

Content

No source excerpt is available for this finding.

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · scripts/manual_login.py (reported line 35)May include surrounding context.

python

try:
            # 无限等待，直到页面被关闭
            page.wait_for_event("close", timeout=0)
        except Exception as e:
            print(f"等待过程中断: {e}")
        finally:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script performs a real publication action on xiaohongshu.com by clicking the final '发布' button with no explicit user confirmation, dry-run mode, or safety interlock. Because it reuses stored authenticated cookies, any caller that invokes this script can cause unintended or irreversible posting to a live account, creating account misuse, spam, reputational harm, or policy violations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script automatically loads an authenticated Playwright storage state from a local cookies file and immediately uses it to perform searches on behalf of a logged-in Xiaohongshu user. In a skill explicitly designed to interact with a social platform, this creates session-reuse risk and can cause actions to be performed under a real user account without clear consent, visibility, or safeguards around whose cookies are being used.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The file uses Chinese natural-language text in the docstring/comment and depends on a button named "登录" to determine login state. This creates a locale-specific behavior without any documented opt-in or fallback, which can violate language/locale policy requirements.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The function loads persisted authenticated cookies from disk and immediately performs a live request to xiaohongshu.com to determine login state, without any in-file disclosure, consent prompt, or guardrail around use of those session credentials. In a skill whose purpose is to automate actions on a social platform, silent reuse of stored authenticated state increases privacy and account-misuse risk because simply calling a validation helper contacts the platform as the user and may reveal or exercise session validity unexpectedly.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The user-facing docstring, CLI description, argument help text, and runtime messages are all written only in Chinese, which imposes a specific language on users without any opt-in or alternative. This is a natural-language policy concern because the skill does not document a justified locale restriction or provide language choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The docstring, error messages, status output, and CLI help are all hard-coded in Chinese, which imposes a specific language on users. There is no opt-in, alternate locale support, or justification that this skill is intentionally limited to a Chinese-speaking audience.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill's natural-language docstrings, CLI description, and status messages are all fixed in Chinese, which imposes a specific language on users without opt-in. This matches the language/locale policy violation category because no alternative language option or explicit locale justification is provided.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Docstrings, status messages, and CLI help text are all hardcoded in Chinese, which imposes a specific language on users without any opt-in or explanation. The policy allows locale constraints when they are justified or optional, but this file does not provide either.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The docstring and all printed instructions are in Chinese, which imposes a specific language on users without opt-in or justification. This matches the language/locale policy concern for natural-language content that forces a locale choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Natural-language strings throughout the file, including status messages, errors, docstrings, and CLI help text, are presented only in Chinese. This can violate a language/locale policy when a skill forces a specific language without giving the user an explicit choice or documenting the locale restriction.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.