Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent Xiaohongshu research helper that stores local reports and uses a local Xiaohongshu MCP service as disclosed.
Before installing, be aware that the skill expects a running local Xiaohongshu MCP service with a logged-in account and will save searched post metadata, generated reports, and research metadata under ~/xiaohongshu-research/. Review or delete that folder if the topics are sensitive.
The skill description and writing guidance are written to produce Chinese output, including Chinese phrasing and style requirements, but there is no indication that the user can opt into another language. This creates a language policy concern because the skill appears to mandate a specific locale without explicit user choice or justification.
The skill explicitly defines a local storage path and states that raw posts, generated analysis, and metadata will be written under the user's home directory, but the skill description does not warn the user about this persistence behavior. That creates a transparency and privacy issue: users may trigger research expecting ephemeral processing while the skill saves potentially sensitive queries, collected content, and derived reports to disk.
The document title and all writing instructions are in Chinese, and the template explicitly directs the generated report to be written in Chinese-style phrasing such as '像给朋友发消息一样写'. There is no indication that users may choose another language or that the locale restriction is optional or justified as region-specific compliance.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -s -X POST "http://localhost:18060/api/v1/feeds/search" \
-H "Content-Type: application/json" \
-d '{"keyword": "露营"}'
No suspicious patterns detected.