T08 · Insecure Dependencies
Warning
- Location
SKILL.md:24- Finding
Unpinned External Skill Installation and Execution
- Content
View full analysis
- Remediation
View remediation
Security audit
Kay Xhs
Security checks for vulnerabilities and agentic risk
Overview
This skill is mostly a disclosed Xiaohongshu content workflow, but it needs Review because it combines account automation, third-party data extraction, unpinned credential-using dependency installation, and mandatory persistent memory writes without enough scoping controls.
Install only if you are comfortable granting the skill access to a logged-in Xiaohongshu creator session, uploading selected local images, using a KIE API key with the separate kay-image dependency, and writing workflow history into persistent memory. Prefer a narrowly scoped API key, verify or pin kay-image before use, review files and draft contents before any browser upload/click, and disable or manually approve memory archival unless you want long-term retention.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T02 · Agent Memory Poisoning
Warning
- Location
SKILL.md:726- Finding
Unbounded Persistent Agent Memory Modification
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (13)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md clawhub install kay-image # 配置 API Key cp skills/kay-image/.env.example skills/kay-image/.env # 编辑 .env 文件，填入从 https://kie.ai/ 获取的 API Key nano skills/kay-image/.env
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md clawhub install kay-image # 配置 API Key cp skills/kay-image/.env.example skills/kay-image/.env # 编辑 .env 文件，填入从 https://kie.ai/ 获取的 API Key nano skills/kay-image/.env
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md clawhub install kay-image # 配置 API Key cp skills/kay-image/.env.example skills/kay-image/.env # 编辑 .env 文件，填入从 https://kie.ai/ 获取的 API Key nano skills/kay-image/.env
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill provides detailed automated scraping/extraction steps for images, note content, authors, likes, and comments from Xiaohongshu without an explicit privacy notice or collection limitation. Bulk extraction of third-party content and comments can violate platform expectations, increase privacy exposure, and normalize collection of user-generated data without transparency.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The auto-publishing section performs file uploads and account-state changes on the user's Xiaohongshu creator account, but the skill does not present a clear user-facing warning about local file transfer and browser-side modification of drafts. This can lead to unintended uploads or account actions if the user does not understand the automation boundary.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill instructs persistent writes of daily logs, lessons, and a master knowledge file that are not clearly disclosed in the manifested capability summary. This creates an unbounded local retention channel for user prompts, generated content, and workflow metadata, increasing privacy and data-governance risk beyond the user's likely expectation for a publishing workflow.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Mandatory post-session archival instructions create a standing record of user-provided content, outputs, and operational history in memory files. Persistent session logging increases the blast radius of any local compromise and can retain sensitive business content longer than necessary.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This markdown file presents all skill guidance exclusively in Chinese, and there is no indication that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking or region-specific audience. That creates a natural-language policy concern under the locale/language rule because the skill effectively forces a specific language without opt-in.
- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
📁 文档更新位置
text skills/kay-xhs/SKILL.md ├── Phase 4: AI 生图 │ ├── 4.1 封面生成 │ ├── 4.2 四格漫画生成
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This markdown file contains substantive skill-related content entirely in Chinese, but does not state that the skill is Chinese-only or offer any user language/locale choice. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The instruction to access a separate local prompt warehouse path expands the skill's data reach beyond the stated Xiaohongshu workflow. Unnecessary reads from unrelated local prompt repositories can expose unrelated proprietary or sensitive prompts and create covert cross-context data use.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This markdown file presents all instructions, labels, and examples in Chinese only, which effectively forces a specific language on users. Under the stated policy, language-specific behavior should either offer user opt-in/choice or be clearly justified as region-specific.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
This markdown file includes shell commands that create
comic-tasks.json, write output images to./output, and explicitly notes deleting the JSON file in the execution flow. The section presents these filesystem-affecting actions as routine usage but does not include any warning about local file modification, overwrite risk, or cleanup behavior.- Content