小红书自动化

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:36 PM UTC
• Version: 1.0.1

Overview

This skill does what it advertises, but it handles live social-media account credentials and publishing authority with weak containment and some under-disclosed risky defaults.

Review this before installing on an account you care about. Use a test Xiaohongshu account first, keep auto-publish disabled unless you explicitly want public posts, restrict cookie and openclaw.json permissions, avoid running the bundled SSE MCP server on a network interface, and rotate/remove stored cookies and API keys when uninstalling.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (6)

T03 · Remote Payload Retrieval and Execution

Error

• Location: install.sh:39
• Finding: Remote Script Execution Recommended Through curl-to-shell Installation<![CDATA[ ## Vulnerability Details **File Location**: `install.sh:39-42` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```bash # uv if ! command -v uv &>/dev/null; then fail "uv not found. Install it first:\n brew install uv (macOS)\n curl -LsSf https://astral.sh/uv/install.sh | sh (Linux)" fi ``` ### Technical Analysis The installer directs users to download a mutable remote shell script and immediately execute it through a pipeline: ```bash curl -LsSf https://astral.sh/uv/install.sh | sh ``` This design does not pin a release, verify a cryptographic checksum or signature, or give the user an opportunity to inspect the retrieved file. The effective code executed by the user can therefore change after this Skill has been reviewed. The command is presented as an instruction rather than executed automatically by `install.sh`. Nevertheless, users following the installer’s prescribed recovery procedure will execute code controlled by the remote endpoint. The repository does not contain evidence that could guarantee the integrity of all future responses from that endpoint. ### Attack Path 1. A user runs `install.sh` without `uv` installed. 2. The installer exits and displays the curl-to-shell command. 3. The user follows the displayed instruction. 4. An attacker who has compromised the remote endpoint, its hosting infrastructure, or a relevant trust dependency serves modified shell code. 5. `sh` executes the response immediately under the installing user’s account. ### Impact Assessment Successful exploitation provides arbitrary code execution with the privileges of the user performing installation. This can expose local files, OpenClaw credentials, Xiaohongshu session cookies, API keys, and any other resources available to that account. The remote payload could also install persistence or modify the installed Skill without further confirmation. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove all curl-to-shell and PowerShell download-to-execution instructions. - Recommend a trusted operating-system package manager where available. - Otherwise require users to download a versioned release artifact separately. - Pin the expected uv release instead of retrieving the latest mutable installer. - Publish and verify a SHA-256 or stronger digest before execution. - Prefer signature verification using a documented, pinned signing key. - Separate download, verification, inspection, and execution into distinct commands. - Update `xhs-toolkit/install_deps.py` as well, because it repeats similar unsafe installation guidance. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: xhs-toolkit/src/core/config.py:58
• Finding: Unauthenticated MCP Service Listens on All Network Interfaces by Default<![CDATA[ ## Vulnerability Details **File Locations**: `xhs-toolkit/src/core/config.py:58-59`, `xhs-toolkit/src/server/mcp_server.py:896-902` **Vulnerability Type**: Missing authentication and unsafe network binding **Risk Level**: High ### Vulnerable Code Default network configuration: ```python self.server_host = os.getenv("SERVER_HOST", "0.0.0.0") self.server_port = int(os.getenv("SERVER_PORT", "8000")) ``` SSE server startup: ```python try: # 使用FastMCP内置的run方法，禁用uvicorn的日志以避免干扰MCP通信 import logging logging.getLogger("uvicorn").setLevel(logging.WARNING) logging.getLogger("uvicorn.access").setLevel(logging.WARNING) self.mcp.run(transport="sse", port=self.config.server_port, host=self.config.server_host) ``` Sensitive MCP tools are registered in the same server, including: ```python @self.mcp.tool() async def smart_publish_note(title: str, content: str, images=None, videos=None, ``` ```python @self.mcp.tool() async def login_xiaohongshu(force_relogin: bool = False, quick_mode: bool = False) -> str: ``` ### Technical Analysis The MCP server defaults to `0.0.0.0:8000`, making it reachable through all available interfaces, including LAN, container, and potentially public interfaces depending on firewall and deployment configuration. No authentication or authorization middleware was identified around the MCP tools during the audit. The exposed tools are not read-only: they include note publication, login initiation, task-result retrieval, and creator analytics access. These operations can use the victim’s persisted browser state and Xiaohongshu cookies. The local-IP discovery at `mcp_server.py:857-866` is primarily used to advertise the listening endpoint and is not, by itself, broad environment reconnaissance. However, it confirms that LAN access is an intended server mode. ### Attack Path 1. The user starts the MCP server without overriding `SERVER_HOST`. 2. The service listens on `0.0.0.0:8000`. 3. An attacker on a reachab ...[truncated 879 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Change the default bind address from `0.0.0.0` to `127.0.0.1`. - Disable SSE transport by default and require an explicit opt-in setting. - Require strong authentication for every SSE/MCP connection. - Apply per-tool authorization, with separate permission checks for publishing, login, and analytics operations. - Use short-lived, audience-bound access tokens and constant-time token validation. - Require explicit user confirmation immediately before publication or other account-changing actions. - Add origin and host validation where supported. - Document firewall controls for users who intentionally enable remote access. - Consider mutual TLS or a trusted authenticated reverse proxy for non-local deployments. - Add rate limits and security audit logs without recording secrets or cookies. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: xhs-toolkit/src/utils/image_processor.py:104
• Finding: Server-Side Request Forgery Through Unrestricted Remote Image Downloads<![CDATA[ ## Vulnerability Details **File Location**: `xhs-toolkit/src/utils/image_processor.py:104-145` **Vulnerability Type**: Server-side request forgery and unbounded remote download **Risk Level**: High ### Vulnerable Code ```python if not isinstance(img_input, str): logger.warning(f"⚠️ 无效的图片输入类型: {type(img_input)}") return None # 检查是否是网络地址 if img_input.startswith(('http://', 'https://')): # 网络地址 return await self._download_from_url(img_input, index) elif os.path.exists(img_input): # 本地文件 return os.path.abspath(img_input) else: logger.warning(f"⚠️ 无效的图片路径: {img_input}") return None async def _download_from_url(self, url: str, index: int) -> Optional[str]: """ 下载网络图片到本地 Args: url: 图片URL index: 图片索引 Returns: Optional[str]: 本地文件路径，失败返回None """ try: logger.info(f"⬇️ 开始下载图片: {url}") async with aiohttp.ClientSession() as session: async with session.get(url, timeout=aiohttp.ClientTimeout(total=30)) as response: if response.status != 200: logger.error(f"❌ 下载图片失败: {url}, 状态码: {response.status}") return None # 获取文件扩展名 content_type = response.headers.get('content-type', '') ext = self._get_extension_from_content_type(content_type) if not ext: # 从URL中尝试获取扩展名 url_path = Path(url.split('?')[0]) ext = url_path.suffix or '.jpg' # 生成唯一文件名 filename = f"download_{index}_{uuid.uuid4().hex[:8]}{ext}" filepath = self.temp_dir / filename # 保存文件 content = await response.read() filepath.write_bytes(content) ``` ### Technical Analysis The image processor accepts arbitrary `http://` and `https://` URLs and fetches them fro ...[truncated 1851 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Permit only HTTPS URLs unless plain HTTP is explicitly required. - Resolve destination hostnames before connecting and reject loopback, private, link-local, multicast, unspecified, and reserved addresses for both IPv4 and IPv6. - Re-run destination validation after every redirect and limit redirect count. - Protect against DNS rebinding by connecting only to the validated resolved address while preserving safe TLS hostname verification. - Prefer an explicit allowlist of approved image-hosting domains. - Stream responses in bounded chunks rather than using `response.read()`. - Reject responses exceeding a strict size limit based on both `Content-Length` and bytes actually received. - Require an approved image MIME type and verify decoded image content before persistence. - Set connection, read, and total timeouts separately. - Place downloads in a restricted temporary directory and remove them reliably after processing. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: xhs-toolkit/src/auth/cookie_manager.py:541
• Finding: Xiaohongshu Session Cookies Are Persisted in Plaintext Without Enforced Permissions<![CDATA[ ## Vulnerability Details **File Location**: `xhs-toolkit/src/auth/cookie_manager.py:541-567` **Vulnerability Type**: Insecure storage of authentication credentials **Risk Level**: High ### Vulnerable Code ```python # 创建cookies目录 cookies_dir = Path(self.config.cookies_dir) logger.info(f"📁 cookies目录: {cookies_dir}") cookies_dir.mkdir(parents=True, exist_ok=True) logger.info("✅ cookies目录创建成功") # 构建新格式的cookies数据 logger.info("📦 构建cookies数据结构...") cookies_data = { 'cookies': cookies, 'saved_at': datetime.now().isoformat(), 'domain': 'creator.xiaohongshu.com', # 标记为创作者中心cookies 'critical_cookies_found': validation_result["found_critical"], 'version': '2.0' # 版本标记 } logger.info(f"📦 数据结构构建完成，包含 {len(cookies)} 个cookies") # 保存cookies cookies_file = Path(self.config.cookies_file) logger.info(f"💾 准备写入文件: {cookies_file}") with open(cookies_file, 'w', encoding='utf-8') as f: json.dump(cookies_data, f, ensure_ascii=False, indent=2) ``` A second cookie persistence path was also observed at `scripts/xhs_login_persistent.py:67-76`: ```python # Export cookies to JSON file cookies = driver.get_cookies() data = { "cookies": cookies, } Path(cookies_file).parent.mkdir(parents=True, exist_ok=True) Path(cookies_file).write_text(json.dumps(data, ensure_ascii=False, indent=2)) ``` ### Technical Analysis Persisting session cookies is necessary for the declared authenticated automation features. However, the implementation stores the complete browser cookie collection as plaintext JSON and does not enforce restrictive permissions on either the directory or file. `mkdir(..., exist_ok=True)` relies on the process umask and does not correct an existing directory’s permissions. Likewise, `open(..., 'w')` and `Path.write_text()` do not guarantee mode `0600`, especially when overwriting an existing permissively configured file. Xiaohongshu session cookies can function as bearer credentials. A process that reads the cookie file may be able to ...[truncated 1076 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Store session credentials in the operating system’s protected keyring or credential vault where feasible. - If a file is unavoidable, create the credential directory with mode `0700`. - Atomically create the cookie file with mode `0600`, without a permissive intermediate file. - Explicitly correct permissions on existing directories and files. - Avoid following symbolic links when creating or replacing the credential file. - Use a temporary file in the same protected directory, flush and synchronize it, then atomically replace the destination. - Minimize retained cookies to those strictly necessary for the target domain and functionality. - Avoid logging cookie values and review whether cookie names themselves need to be logged. - Provide a command to revoke sessions and securely remove local credential material. - Apply the same controls to every cookie write path, including `scripts/xhs_login_persistent.py`. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: install.sh:144
• Finding: API Keys and Gateway Tokens Are Exposed Through Process Arguments and Plaintext Configuration<![CDATA[ ## Vulnerability Details **File Locations**: `install.sh:144-173`, `scripts/configure_openclaw.py:39-50` **Vulnerability Type**: Insecure secret handling **Risk Level**: Medium ### Vulnerable Code The installer reads an existing gateway token and passes secrets through command-line arguments: ```bash # Try to read existing gateway token GATEWAY_TOKEN=$(python3 -c " import json, sys try: cfg = json.load(open('$OPENCLAW_CONFIG')) token = cfg.get('gateway', {}).get('token', '') if not token: # Try to find it in existing xhs config token = cfg.get('skills', {}).get('entries', {}).get('xhs', {}).get('env', {}).get('OPENCLAW_GATEWAY_TOKEN', '') print(token) except: print('') " 2>/dev/null || echo "") if [[ -z "$GATEWAY_TOKEN" ]]; then GATEWAY_TOKEN="<SET_YOUR_GATEWAY_TOKEN>" warn "Could not detect gateway token. Set OPENCLAW_GATEWAY_TOKEN in openclaw.json." fi # Inject config using the helper script (safe JSON manipulation) python3 "$REPO_DIR/scripts/configure_openclaw.py" \ --config "$OPENCLAW_CONFIG" \ --toolkit-dir "$TOOLKIT_DIR" \ --cookies-file "$CRED_DIR/xhs_cookies.json" \ --data-dir "$SKILL_DIR/data" \ --chrome-profile "$SKILL_DIR/chrome-data" \ --chrome-path "$CHROME_PATH" \ --image-api-key "$IMAGE_KEY" \ --image-base-url "$IMAGE_URL" \ --image-model "$IMAGE_MDL" \ --gateway-token "$GATEWAY_TOKEN" ``` The configuration helper stores those values in plaintext JSON: ```python if args.image_api_key: env["IMAGE_API_KEY"] = args.image_api_key if args.image_base_url: env["IMAGE_BASE_URL"] = args.image_base_url if args.image_model: env["IMAGE_MODEL"] = args.image_model if args.gateway_token: env["OPENCLAW_GATEWAY_TOKEN"] = args.gateway_token cfg["skills"]["entries"]["xhs"] = {"env": env} config_path.write_text(json.dumps(cfg, indent=2, ensure_ascii=False)) ``` The API key is also collected through a visibly echoed prompt at `install.sh:128`: ``` ...[truncated 1649 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Use `read -s` for secret entry and print a newline after input. - Do not pass secrets through command-line arguments. - Supply secrets through a protected standard-input channel, inherited file descriptor, keyring lookup, or dedicated secret manager. - Avoid retaining sensitive values in shell variables longer than necessary and unset them after configuration. - Store secret references rather than raw secret values in general configuration files. - If plaintext configuration is unavoidable, enforce mode `0600` and a parent directory mode of `0700`. - Correct permissions on existing configuration files before writing. - Use atomic, symlink-safe file replacement. - Ensure logs, exception messages, and diagnostics never include secret arguments or values. - Rotate any credentials that may previously have been exposed through process inspection or permissive configuration files. ]]>

T08 · Insecure Dependencies

Warning

• Location: xhs-toolkit/pyproject.toml:21
• Finding: Install Process Resolves Unpinned and Open-Ended Third-Party Dependencies<![CDATA[ ## Vulnerability Details **File Locations**: `xhs-toolkit/pyproject.toml:21-35`, `install.sh:101-107` **Vulnerability Type**: Unpinned software supply-chain dependencies **Risk Level**: Medium ### Vulnerable Code ```toml dependencies = [ "fastmcp>=2.0.0", "requests>=2.31.0", "aiohttp>=3.9.0", "fastapi>=0.104.0", "uvicorn>=0.24.0", "selenium>=4.15.0", "pydantic>=2.5.0", "python-multipart>=0.0.6", "pandas>=2.0.0", "cryptography>=41.0.0", "pycryptodome>=3.19.0", "python-dotenv>=1.0.0", "loguru>=0.7.2", "apscheduler>=3.10.0", ] ``` ```bash info "Installing Python dependencies (uv sync) ..." cd "$TOOLKIT_DIR" uv sync 2>&1 | tail -5 ok "Python dependencies installed" # Also install extra deps used by scripts (jieba, Pillow) info "Installing extra dependencies (jieba, Pillow) ..." uv pip install jieba Pillow 2>&1 | tail -3 ok "Extra dependencies installed" ``` ### Technical Analysis The declared dependencies use open-ended lower bounds. This permits future versions to be selected at installation time. The installer additionally installs `jieba` and `Pillow` without any version or hash constraints. No lockfile was listed in the supplied project structure. Consequently, two users installing the same reviewed source at different times may receive materially different dependency code. This is not evidence that any currently named package is malicious. The risk arises from mutable dependency resolution, compromise of a package or package index, and unreviewed future releases. ### Attack Path 1. A user runs the project installer. 2. `uv sync` resolves versions allowed by the open-ended constraints. 3. `uv pip install jieba Pillow` resolves the latest acceptable releases independently. 4. A compromised, malicious, or unexpectedly incompatible future package release is selected. 5. Package installation or runtime imports execute the newly resolved code under the user account. 6. That code can access ...[truncated 509 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Generate and commit a reviewed `uv.lock` file. - Install production environments using the locked dependency graph. - Pin direct dependencies to reviewed versions or suitably narrow compatible ranges. - Add `jieba` and `Pillow` to `pyproject.toml` so they are included in the same lock and review process. - Use hash verification for distributable artifacts where supported. - Review transitive dependencies and package provenance before updating the lockfile. - Run dependency vulnerability and license scanning in continuous integration. - Use an automated update process that creates reviewable, tested changes rather than resolving arbitrary new versions during installation. - Consider a controlled package mirror for higher-assurance deployments. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (248)

Tainted flow: 'url' from os.environ.get (line 255, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

max_retries = 2
        for attempt in range(max_retries + 1):
            try:
                resp = req.post(
                    url,
                    headers={
                        "Authorization": f"Bearer {api_key}",

• Confidence: 95% confidence
• Finding: The image-generation endpoint is taken from environment configuration and used directly for authenticated outbound requests. If this value is misconfigured or attacker-controlled, the script will send prompts and the bearer token to an arbitrary host, enabling SSRF-like behavior and credential exfiltration; the skill context makes this more dangerous because it is explicitly designed to run unattended through exec with networked automation.

Missing User Warnings

High

• Confidence: 94% confidence
• Finding: Describing the system as capable of fully automated upload, form filling, clicking publish, and end-to-end publishing without warning about external side effects normalizes a destructive automation flow. In this skill's context, the danger is elevated because the tool operates on a logged-in social-media account and can publicly post content at scale, causing reputational, compliance, or account-security harm if triggered unintentionally or abused.

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: The README promotes fully automated posting to Xiaohongshu without prominently warning that automation can publish unwanted or policy-violating content, damage account reputation, or trigger account enforcement. In this skill's context, the danger is elevated because the tool is explicitly designed to log in, generate content, and publish through exec-driven automation, making unintended side effects materially likely.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill description advertises a narrow exec-based Xiaohongshu workflow, but the referenced behavior set includes additional host modification, configuration editing, dependency installation, credential handling, browser automation, and data persistence capabilities. That mismatch is dangerous because users and reviewers may approve the skill for one purpose while it exercises broader and more sensitive powers than declared.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill description advertises a narrow exec-based Xiaohongshu workflow, but the referenced behavior set includes additional host modification, configuration editing, dependency installation, credential handling, browser automation, and data persistence capabilities. That mismatch is dangerous because users and reviewers may approve the skill for one purpose while it exercises broader and more sensitive powers than declared.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill description advertises a narrow exec-based Xiaohongshu workflow, but the referenced behavior set includes additional host modification, configuration editing, dependency installation, credential handling, browser automation, and data persistence capabilities. That mismatch is dangerous because users and reviewers may approve the skill for one purpose while it exercises broader and more sensitive powers than declared.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill description advertises a narrow exec-based Xiaohongshu workflow, but the referenced behavior set includes additional host modification, configuration editing, dependency installation, credential handling, browser automation, and data persistence capabilities. That mismatch is dangerous because users and reviewers may approve the skill for one purpose while it exercises broader and more sensitive powers than declared.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill description advertises a narrow exec-based Xiaohongshu workflow, but the referenced behavior set includes additional host modification, configuration editing, dependency installation, credential handling, browser automation, and data persistence capabilities. That mismatch is dangerous because users and reviewers may approve the skill for one purpose while it exercises broader and more sensitive powers than declared.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill description advertises a narrow exec-based Xiaohongshu workflow, but the referenced behavior set includes additional host modification, configuration editing, dependency installation, credential handling, browser automation, and data persistence capabilities. That mismatch is dangerous because users and reviewers may approve the skill for one purpose while it exercises broader and more sensitive powers than declared.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill description advertises a narrow exec-based Xiaohongshu workflow, but the referenced behavior set includes additional host modification, configuration editing, dependency installation, credential handling, browser automation, and data persistence capabilities. That mismatch is dangerous because users and reviewers may approve the skill for one purpose while it exercises broader and more sensitive powers than declared.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill description advertises a narrow exec-based Xiaohongshu workflow, but the referenced behavior set includes additional host modification, configuration editing, dependency installation, credential handling, browser automation, and data persistence capabilities. That mismatch is dangerous because users and reviewers may approve the skill for one purpose while it exercises broader and more sensitive powers than declared.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill description advertises a narrow exec-based Xiaohongshu workflow, but the referenced behavior set includes additional host modification, configuration editing, dependency installation, credential handling, browser automation, and data persistence capabilities. That mismatch is dangerous because users and reviewers may approve the skill for one purpose while it exercises broader and more sensitive powers than declared.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill description advertises a narrow exec-based Xiaohongshu workflow, but the referenced behavior set includes additional host modification, configuration editing, dependency installation, credential handling, browser automation, and data persistence capabilities. That mismatch is dangerous because users and reviewers may approve the skill for one purpose while it exercises broader and more sensitive powers than declared.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill description advertises a narrow exec-based Xiaohongshu workflow, but the referenced behavior set includes additional host modification, configuration editing, dependency installation, credential handling, browser automation, and data persistence capabilities. That mismatch is dangerous because users and reviewers may approve the skill for one purpose while it exercises broader and more sensitive powers than declared.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill description advertises a narrow exec-based Xiaohongshu workflow, but the referenced behavior set includes additional host modification, configuration editing, dependency installation, credential handling, browser automation, and data persistence capabilities. That mismatch is dangerous because users and reviewers may approve the skill for one purpose while it exercises broader and more sensitive powers than declared.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill description advertises a narrow exec-based Xiaohongshu workflow, but the referenced behavior set includes additional host modification, configuration editing, dependency installation, credential handling, browser automation, and data persistence capabilities. That mismatch is dangerous because users and reviewers may approve the skill for one purpose while it exercises broader and more sensitive powers than declared.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill description advertises a narrow exec-based Xiaohongshu workflow, but the referenced behavior set includes additional host modification, configuration editing, dependency installation, credential handling, browser automation, and data persistence capabilities. That mismatch is dangerous because users and reviewers may approve the skill for one purpose while it exercises broader and more sensitive powers than declared.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill description advertises a narrow exec-based Xiaohongshu workflow, but the referenced behavior set includes additional host modification, configuration editing, dependency installation, credential handling, browser automation, and data persistence capabilities. That mismatch is dangerous because users and reviewers may approve the skill for one purpose while it exercises broader and more sensitive powers than declared.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill description advertises a narrow exec-based Xiaohongshu workflow, but the referenced behavior set includes additional host modification, configuration editing, dependency installation, credential handling, browser automation, and data persistence capabilities. That mismatch is dangerous because users and reviewers may approve the skill for one purpose while it exercises broader and more sensitive powers than declared.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill description advertises a narrow exec-based Xiaohongshu workflow, but the referenced behavior set includes additional host modification, configuration editing, dependency installation, credential handling, browser automation, and data persistence capabilities. That mismatch is dangerous because users and reviewers may approve the skill for one purpose while it exercises broader and more sensitive powers than declared.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill description advertises a narrow exec-based Xiaohongshu workflow, but the referenced behavior set includes additional host modification, configuration editing, dependency installation, credential handling, browser automation, and data persistence capabilities. That mismatch is dangerous because users and reviewers may approve the skill for one purpose while it exercises broader and more sensitive powers than declared.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill description advertises a narrow exec-based Xiaohongshu workflow, but the referenced behavior set includes additional host modification, configuration editing, dependency installation, credential handling, browser automation, and data persistence capabilities. That mismatch is dangerous because users and reviewers may approve the skill for one purpose while it exercises broader and more sensitive powers than declared.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill description advertises a narrow exec-based Xiaohongshu workflow, but the referenced behavior set includes additional host modification, configuration editing, dependency installation, credential handling, browser automation, and data persistence capabilities. That mismatch is dangerous because users and reviewers may approve the skill for one purpose while it exercises broader and more sensitive powers than declared.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill description advertises a narrow exec-based Xiaohongshu workflow, but the referenced behavior set includes additional host modification, configuration editing, dependency installation, credential handling, browser automation, and data persistence capabilities. That mismatch is dangerous because users and reviewers may approve the skill for one purpose while it exercises broader and more sensitive powers than declared.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill description advertises a narrow exec-based Xiaohongshu workflow, but the referenced behavior set includes additional host modification, configuration editing, dependency installation, credential handling, browser automation, and data persistence capabilities. That mismatch is dangerous because users and reviewers may approve the skill for one purpose while it exercises broader and more sensitive powers than declared.

Static analysis

No suspicious patterns detected.