小红书自动化

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:36 PM UTC
• Version: 1.0.1

Overview

This skill does what it advertises, but it handles live social-media account credentials and publishing authority with weak containment and some under-disclosed risky defaults.

Review this before installing on an account you care about. Use a test Xiaohongshu account first, keep auto-publish disabled unless you explicitly want public posts, restrict cookie and openclaw.json permissions, avoid running the bundled SSE MCP server on a network interface, and rotate/remove stored cookies and API keys when uninstalling.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (6)

T03 · Remote Payload Retrieval and Execution

Error

• Location: install.sh:39

Finding

Remote Script Execution Recommended Through curl-to-shell Installation

Content

View full analysis

/dev/null; then fail "uv not found. Install it first:\n brew install uv (macOS)\n curl -LsSf https://astral.sh/uv/install.sh | sh (Linux)" fi ``` ### Technical Analysis The installer directs users to download a mutable remote shell script and immediately execute it through a pipeline: ```bash curl -LsSf https://astral.sh/uv/install.sh | sh ``` This design does not pin a release, verify a cryptographic checksum or signature, or give the user an opportunity to inspect the retrieved file. The effective code executed by the user can therefore change after this Skill has been reviewed. The command is presented as an instruction rather than executed automatically by `install.sh`. Nevertheless, users following the installer’s prescribed recovery procedure will execute code controlled by the remote endpoint. The repository does not contain evidence that could guarantee the integrity of all future responses from that endpoint. ### Attack Path 1. A user runs `install.sh` without `uv` installed. 2. The installer exits and displays the curl-to-shell command. 3. The user follows the displayed instruction. 4. An attacker who has compromised the remote endpoint, its hosting infrastructure, or a relevant trust dependency serves modified shell code. 5. `sh` executes the response immediately under the installing user’s account. ### Impact Assessment Successful exploitation provides arbitrary code execution with the privileges of the user performing installation. This can expose local files, OpenClaw credentials, Xiaohongshu session cookies, API keys, and any other resources available to that account. The remote payload could also install persistence or modify the installed Skill without further confirmation. ]]>

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: xhs-toolkit/src/core/config.py:58

Finding

Unauthenticated MCP Service Listens on All Network Interfaces by Default

Content

View full analysis

str: ``` ### Technical Analysis The MCP server defaults to `0.0.0.0:8000`, making it reachable through all available interfaces, including LAN, container, and potentially public interfaces depending on firewall and deployment configuration. No authentication or authorization middleware was identified around the MCP tools during the audit. The exposed tools are not read-only: they include note publication, login initiation, task-result retrieval, and creator analytics access. These operations can use the victim’s persisted browser state and Xiaohongshu cookies. The local-IP discovery at `mcp_server.py:857-866` is primarily used to advertise the listening endpoint and is not, by itself, broad environment reconnaissance. However, it confirms that LAN access is an intended server mode. ### Attack Path 1. The user starts the MCP server without overriding `SERVER_HOST`. 2. The service listens on `0.0.0.0:8000`. 3. An attacker on a reachab ...[truncated 879 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: xhs-toolkit/src/utils/image_processor.py:104

Finding

Server-Side Request Forgery Through Unrestricted Remote Image Downloads

Content

View full analysis

Optional[str]: """ 下载网络图片到本地 Args: url: 图片URL index: 图片索引 Returns: Optional[str]: 本地文件路径，失败返回None """ try: logger.info(f"⬇️ 开始下载图片: {url}") async with aiohttp.ClientSession() as session: async with session.get(url, timeout=aiohttp.ClientTimeout(total=30)) as response: if response.status != 200: logger.error(f"❌ 下载图片失败: {url}, 状态码: {response.status}") return None # 获取文件扩展名 content_type = response.headers.get('content-type', '') ext = self._get_extension_from_content_type(content_type) if not ext: # 从URL中尝试获取扩展名 url_path = Path(url.split('?')[0]) ext = url_path.suffix or '.jpg' # 生成唯一文件名 filename = f"download_{index}_{uuid.uuid4().hex[:8]}{ext}" filepath = self.temp_dir / filename # 保存文件 content = await response.read() filepath.write_bytes(content) ``` ### Technical Analysis The image processor accepts arbitrary `http://` and `https://` URLs and fetches them fro ...[truncated 1851 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: xhs-toolkit/src/auth/cookie_manager.py:541

Finding

Xiaohongshu Session Cookies Are Persisted in Plaintext Without Enforced Permissions

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: install.sh:144

Finding

API Keys and Gateway Tokens Are Exposed Through Process Arguments and Plaintext Configuration

Content

View full analysis

/dev/null || echo "") if [[ -z "$GATEWAY_TOKEN" ]]; then GATEWAY_TOKEN="" warn "Could not detect gateway token. Set OPENCLAW_GATEWAY_TOKEN in openclaw.json." fi # Inject config using the helper script (safe JSON manipulation) python3 "$REPO_DIR/scripts/configure_openclaw.py" \ --config "$OPENCLAW_CONFIG" \ --toolkit-dir "$TOOLKIT_DIR" \ --cookies-file "$CRED_DIR/xhs_cookies.json" \ --data-dir "$SKILL_DIR/data" \ --chrome-profile "$SKILL_DIR/chrome-data" \ --chrome-path "$CHROME_PATH" \ --image-api-key "$IMAGE_KEY" \ --image-base-url "$IMAGE_URL" \ --image-model "$IMAGE_MDL" \ --gateway-token "$GATEWAY_TOKEN" ``` The configuration helper stores those values in plaintext JSON: ```python if args.image_api_key: env["IMAGE_API_KEY"] = args.image_api_key if args.image_base_url: env["IMAGE_BASE_URL"] = args.image_base_url if args.image_model: env["IMAGE_MODEL"] = args.image_model if args.gateway_token: env["OPENCLAW_GATEWAY_TOKEN"] = args.gateway_token cfg["skills"]["entries"]["xhs"] = {"env": env} config_path.write_text(json.dumps(cfg, indent=2, ensure_ascii=False)) ``` The API key is also collected through a visibly echoed prompt at `install.sh:128`: ``` ...[truncated 1649 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: xhs-toolkit/pyproject.toml:21

Finding

Install Process Resolves Unpinned and Open-Ended Third-Party Dependencies

Content

View full analysis

=2.0.0", "requests>=2.31.0", "aiohttp>=3.9.0", "fastapi>=0.104.0", "uvicorn>=0.24.0", "selenium>=4.15.0", "pydantic>=2.5.0", "python-multipart>=0.0.6", "pandas>=2.0.0", "cryptography>=41.0.0", "pycryptodome>=3.19.0", "python-dotenv>=1.0.0", "loguru>=0.7.2", "apscheduler>=3.10.0", ] ``` ```bash info "Installing Python dependencies (uv sync) ..." cd "$TOOLKIT_DIR" uv sync 2>&1 | tail -5 ok "Python dependencies installed" # Also install extra deps used by scripts (jieba, Pillow) info "Installing extra dependencies (jieba, Pillow) ..." uv pip install jieba Pillow 2>&1 | tail -3 ok "Extra dependencies installed" ``` ### Technical Analysis The declared dependencies use open-ended lower bounds. This permits future versions to be selected at installation time. The installer additionally installs `jieba` and `Pillow` without any version or hash constraints. No lockfile was listed in the supplied project structure. Consequently, two users installing the same reviewed source at different times may receive materially different dependency code. This is not evidence that any currently named package is malicious. The risk arises from mutable dependency resolution, compromise of a package or package index, and unreviewed future releases. ### Attack Path 1. A user runs the project installer. 2. `uv sync` resolves versions allowed by the open-ended constraints. 3. `uv pip install jieba Pillow` resolves the latest acceptable releases independently. 4. A compromised, malicious, or unexpectedly incompatible future package release is selected. 5. Package installation or runtime imports execute the newly resolved code under the user account. 6. That code can access ...[truncated 509 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (248)

Tainted flow: 'url' from os.environ.get (line 255, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The image-generation endpoint is taken from environment configuration and used directly for authenticated outbound requests. If this value is misconfigured or attacker-controlled, the script will send prompts and the bearer token to an arbitrary host, enabling SSRF-like behavior and credential exfiltration; the skill context makes this more dangerous because it is explicitly designed to run unattended through exec with networked automation.

Content

Scanner excerpt · scripts/xhs_generate_content.py (reported line 287)May include surrounding context.

python

max_retries = 2
        for attempt in range(max_retries + 1):
            try:
                resp = req.post(
                    url,
                    headers={
                        "Authorization": f"Bearer {api_key}",

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Describing the system as capable of fully automated upload, form filling, clicking publish, and end-to-end publishing without warning about external side effects normalizes a destructive automation flow. In this skill's context, the danger is elevated because the tool operates on a logged-in social-media account and can publicly post content at scale, causing reputational, compliance, or account-security harm if triggered unintentionally or abused.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README promotes fully automated posting to Xiaohongshu without prominently warning that automation can publish unwanted or policy-violating content, damage account reputation, or trigger account enforcement. In this skill's context, the danger is elevated because the tool is explicitly designed to log in, generate content, and publish through exec-driven automation, making unintended side effects materially likely.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill description advertises a narrow exec-based Xiaohongshu workflow, but the referenced behavior set includes additional host modification, configuration editing, dependency installation, credential handling, browser automation, and data persistence capabilities. That mismatch is dangerous because users and reviewers may approve the skill for one purpose while it exercises broader and more sensitive powers than declared.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill description advertises a narrow exec-based Xiaohongshu workflow, but the referenced behavior set includes additional host modification, configuration editing, dependency installation, credential handling, browser automation, and data persistence capabilities. That mismatch is dangerous because users and reviewers may approve the skill for one purpose while it exercises broader and more sensitive powers than declared.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill description advertises a narrow exec-based Xiaohongshu workflow, but the referenced behavior set includes additional host modification, configuration editing, dependency installation, credential handling, browser automation, and data persistence capabilities. That mismatch is dangerous because users and reviewers may approve the skill for one purpose while it exercises broader and more sensitive powers than declared.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill description advertises a narrow exec-based Xiaohongshu workflow, but the referenced behavior set includes additional host modification, configuration editing, dependency installation, credential handling, browser automation, and data persistence capabilities. That mismatch is dangerous because users and reviewers may approve the skill for one purpose while it exercises broader and more sensitive powers than declared.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill description advertises a narrow exec-based Xiaohongshu workflow, but the referenced behavior set includes additional host modification, configuration editing, dependency installation, credential handling, browser automation, and data persistence capabilities. That mismatch is dangerous because users and reviewers may approve the skill for one purpose while it exercises broader and more sensitive powers than declared.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill description advertises a narrow exec-based Xiaohongshu workflow, but the referenced behavior set includes additional host modification, configuration editing, dependency installation, credential handling, browser automation, and data persistence capabilities. That mismatch is dangerous because users and reviewers may approve the skill for one purpose while it exercises broader and more sensitive powers than declared.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill description advertises a narrow exec-based Xiaohongshu workflow, but the referenced behavior set includes additional host modification, configuration editing, dependency installation, credential handling, browser automation, and data persistence capabilities. That mismatch is dangerous because users and reviewers may approve the skill for one purpose while it exercises broader and more sensitive powers than declared.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill description advertises a narrow exec-based Xiaohongshu workflow, but the referenced behavior set includes additional host modification, configuration editing, dependency installation, credential handling, browser automation, and data persistence capabilities. That mismatch is dangerous because users and reviewers may approve the skill for one purpose while it exercises broader and more sensitive powers than declared.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill description advertises a narrow exec-based Xiaohongshu workflow, but the referenced behavior set includes additional host modification, configuration editing, dependency installation, credential handling, browser automation, and data persistence capabilities. That mismatch is dangerous because users and reviewers may approve the skill for one purpose while it exercises broader and more sensitive powers than declared.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill description advertises a narrow exec-based Xiaohongshu workflow, but the referenced behavior set includes additional host modification, configuration editing, dependency installation, credential handling, browser automation, and data persistence capabilities. That mismatch is dangerous because users and reviewers may approve the skill for one purpose while it exercises broader and more sensitive powers than declared.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill description advertises a narrow exec-based Xiaohongshu workflow, but the referenced behavior set includes additional host modification, configuration editing, dependency installation, credential handling, browser automation, and data persistence capabilities. That mismatch is dangerous because users and reviewers may approve the skill for one purpose while it exercises broader and more sensitive powers than declared.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill description advertises a narrow exec-based Xiaohongshu workflow, but the referenced behavior set includes additional host modification, configuration editing, dependency installation, credential handling, browser automation, and data persistence capabilities. That mismatch is dangerous because users and reviewers may approve the skill for one purpose while it exercises broader and more sensitive powers than declared.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill description advertises a narrow exec-based Xiaohongshu workflow, but the referenced behavior set includes additional host modification, configuration editing, dependency installation, credential handling, browser automation, and data persistence capabilities. That mismatch is dangerous because users and reviewers may approve the skill for one purpose while it exercises broader and more sensitive powers than declared.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill description advertises a narrow exec-based Xiaohongshu workflow, but the referenced behavior set includes additional host modification, configuration editing, dependency installation, credential handling, browser automation, and data persistence capabilities. That mismatch is dangerous because users and reviewers may approve the skill for one purpose while it exercises broader and more sensitive powers than declared.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill description advertises a narrow exec-based Xiaohongshu workflow, but the referenced behavior set includes additional host modification, configuration editing, dependency installation, credential handling, browser automation, and data persistence capabilities. That mismatch is dangerous because users and reviewers may approve the skill for one purpose while it exercises broader and more sensitive powers than declared.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill description advertises a narrow exec-based Xiaohongshu workflow, but the referenced behavior set includes additional host modification, configuration editing, dependency installation, credential handling, browser automation, and data persistence capabilities. That mismatch is dangerous because users and reviewers may approve the skill for one purpose while it exercises broader and more sensitive powers than declared.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill description advertises a narrow exec-based Xiaohongshu workflow, but the referenced behavior set includes additional host modification, configuration editing, dependency installation, credential handling, browser automation, and data persistence capabilities. That mismatch is dangerous because users and reviewers may approve the skill for one purpose while it exercises broader and more sensitive powers than declared.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill description advertises a narrow exec-based Xiaohongshu workflow, but the referenced behavior set includes additional host modification, configuration editing, dependency installation, credential handling, browser automation, and data persistence capabilities. That mismatch is dangerous because users and reviewers may approve the skill for one purpose while it exercises broader and more sensitive powers than declared.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill description advertises a narrow exec-based Xiaohongshu workflow, but the referenced behavior set includes additional host modification, configuration editing, dependency installation, credential handling, browser automation, and data persistence capabilities. That mismatch is dangerous because users and reviewers may approve the skill for one purpose while it exercises broader and more sensitive powers than declared.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill description advertises a narrow exec-based Xiaohongshu workflow, but the referenced behavior set includes additional host modification, configuration editing, dependency installation, credential handling, browser automation, and data persistence capabilities. That mismatch is dangerous because users and reviewers may approve the skill for one purpose while it exercises broader and more sensitive powers than declared.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill description advertises a narrow exec-based Xiaohongshu workflow, but the referenced behavior set includes additional host modification, configuration editing, dependency installation, credential handling, browser automation, and data persistence capabilities. That mismatch is dangerous because users and reviewers may approve the skill for one purpose while it exercises broader and more sensitive powers than declared.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill description advertises a narrow exec-based Xiaohongshu workflow, but the referenced behavior set includes additional host modification, configuration editing, dependency installation, credential handling, browser automation, and data persistence capabilities. That mismatch is dangerous because users and reviewers may approve the skill for one purpose while it exercises broader and more sensitive powers than declared.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.