📕 小红书 Agent Skill

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:47 AM UTC
• Version: 1.0.0

Overview

This skill is a real Xiaohongshu automation tool, but it handles account cookies and can publish, comment, and delete content without strong safeguards.

Install only if you are comfortable giving this skill an active Xiaohongshu session cookie that can read account-related data and publish, comment, or delete content. Use a dedicated/test account where possible, store the cookie with restrictive permissions, avoid copying the shell=True sample into real automation, and prefer a virtual environment with pinned dependencies instead of modifying system Python.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:6

Finding

Unpinned Third-Party Dependencies Installed into the System Python Environment

Content

View full analysis

Remediation

View remediation

click== ``` 2. Generate a lock file containing hashes and install with hash verification: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 3. Review and pin transitive dependencies as well as direct dependencies. 4. Install dependencies inside a dedicated virtual environment rather than the system Python environment. 5. Remove `--break-system-packages` from all installation instructions. 6. Explicitly use a trusted package index and avoid inheriting unreviewed index or mirror configuration. 7. Add automated dependency scanning and periodic review before updating pinned versions. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: xiaohongshu-wrapper.sh:8

Finding

Plaintext Xiaohongshu Session Cookie Stored and Exported Without Permission Validation

Content

View full analysis

Remediation

View remediation

"$HOME/.openclaw/workspace/xiaohongshu-cookies.md" chmod 600 "$HOME/.openclaw/workspace/xiaohongshu-cookies.md" ``` ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (12)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 93% confidence

Finding

The README includes a Python example that constructs a shell command with an f-string and executes it with shell=True. If the keyword value ever becomes attacker-controlled or includes shell metacharacters, this can lead to command injection and arbitrary command execution on the host running the script.

Content

Scanner excerpt · README.md (reported line 160)May include surrounding context.

import time

for keyword in ["Python", "机器学习", "数据分析"]: subprocess.run(f"xiaohongshu-wrapper.sh note search --keyword '{keyword}'", shell=True) time.sleep(3) # 避免风控

text

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description understates the skill's actual capabilities: beyond publishing/searching/comments, it can retrieve current and arbitrary user profile data, delete notes, and browse home-feed recommendations. This mismatch is dangerous because operators or upstream policy engines may grant trust based on the narrow description while the skill can perform broader account-affecting and privacy-impacting actions.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

The example uses subprocess.run(..., shell=True) with string interpolation, which is a classic command-injection pattern if keyword values ever become user-controlled or are copied into production code. In an agent skill context, users often adapt examples directly, so unsafe sample code can lead to arbitrary shell command execution on the host.

Content

Scanner excerpt · SKILL.md (reported line 165)May include surrounding context.

import time

for keyword in ["Python", "机器学习", "数据分析"]: subprocess.run(f"xiaohongshu-wrapper.sh note search --keyword '{keyword}'", shell=True) time.sleep(3) # 避免风控

text

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill is presented as a Xiaohongshu skill, but the README opens with Chinese-first instructions and examples aimed at Chinese-language operation, without stating that language choice is optional. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy concern unless clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence

Finding

The skill exposes environment-based secret handling via XHS_COOKIE but declares no explicit tool scope or permissions boundary. In an agent setting, missing scope declarations can let the skill access or encourage use of sensitive runtime state without clear user consent or sandbox restrictions, increasing the chance of credential misuse or accidental secret exposure.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest description limits the skill to publishing notes, searching content, and managing comments. This file additionally implements note deletion, user information retrieval, current-account inspection, user note enumeration, and home-feed retrieval, which are broader account/content browsing capabilities not reflected in the manifest description.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The delete command performs an irreversible remote state-changing action immediately on invocation, with no confirmation, dry-run, or safeguard. In an agent context, this increases the chance of accidental or prompt-induced deletion of user content and makes misuse materially more dangerous.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script reads a sensitive authentication token from either XHS_COOKIE or a local cookies file and exports it for downstream use. While it errors when the cookie is missing, it does not provide any disclosure about the security sensitivity of the credential, its downstream use, or precautions for storing it in plaintext.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The stated purpose describes controlling Xiaohongshu to post, search, and manage comments, but it does not mention reading credentials from process environment variables. While authentication is needed, silently sourcing cookies from environment state is a distinct capability involving credential access beyond the user-facing purpose statement.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

Posting a comment is a remote write action that can affect the user's account reputation, trigger platform abuse controls, or create unwanted public content, yet it occurs without an operation-specific confirmation. In an autonomous agent setting, even low-impact writes should have friction or explicit authorization because they are externally visible and potentially irreversible.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The script's comments and user-facing error/help messages are entirely in Chinese, which imposes a specific language on users without any opt-in or explanation. Under the stated policy, locale-specific language should be optional or clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The wrapper executes a downstream Python CLI and passes along the exported authentication cookie, but there is no visible notice that a subprocess is being launched or that authenticated actions may occur. For safety-sensitive wrappers, a minimal user-facing disclosure or explanatory comment helps users understand the operational impact.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.