Auto Redbook Skills

• Outcome: Review
• Latest audit: May 29, 2026 · 9:24 PM UTC
• Version: 2.0.0

Overview

This skill is mostly coherent for creating Xiaohongshu posts, but it asks for a live account cookie and renders unsanitized Markdown in a browser, which creates account and network-exposure risks users should review carefully.

Install only if you are comfortable giving the skill publishing authority for your Xiaohongshu account. Keep XHS_COOKIE local, never commit or share .env, prefer dry-run/private tests first, and avoid rendering untrusted Markdown or HTML unless network access is blocked. Pin dependencies before serious use.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (18)

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The generated HTML imports Google Fonts from an external domain during Playwright rendering, which creates unnecessary outbound network access for a local rendering task. This can leak execution metadata such as IP, timing, and usage patterns, and can also make rendering depend on third-party availability.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: Untrusted Markdown is converted to HTML with marked.parse(content) and embedded directly into a Playwright-rendered page without sanitization. Because raw HTML is allowed, an attacker can inject tags such as img, iframe, video, or CSS url() references that trigger arbitrary outbound requests, enabling SSRF-like network access and data exfiltration from the rendering environment.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill tells users to supply a live Xiaohongshu browser cookie and use it to publish posts, but it does not warn that this cookie is effectively an authenticated session credential. If exposed, logged, or mishandled, an attacker or unintended component could post on the user's behalf, access account data, or hijack the account session.

Credential Access

High

• Category: Privilege Escalation

Content

# 小红书 Cookie 配置
# 将此文件复制为 .env 并填入真实的 Cookie
#
# 获取方式：
# 1. 在浏览器中登录小红书 (https://www.xiaohongshu.com)

• Confidence: 94% confidence
• Finding: The file explicitly instructs users to copy their full Xiaohongshu session cookie into a local .env file so the skill can act as the logged-in account. Session cookies are authentication secrets; if exposed through logs, source control, backups, or other tooling, an attacker can hijack the account and perform actions as the user. In this skill’s context, the risk is elevated because the cookie enables publishing to a real social-media account, making account takeover and unauthorized posting plausible impacts.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"author": "",
  "license": "MIT",
  "dependencies": {
    "js-yaml": "^4.1.0",
    "marked": "^11.0.0",
    "playwright": "^1.58.0"
  }

• Confidence: 92% confidence
• Finding: Using caret ranges for dependencies allows newer semver-compatible releases to be installed over time, which can undermine build reproducibility and unexpectedly introduce vulnerable or malicious upstream code. In an agent skill that may be installed automatically, this increases supply-chain risk because the resolved package version can drift without explicit review.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"license": "MIT",
  "dependencies": {
    "js-yaml": "^4.1.0",
    "marked": "^11.0.0",
    "playwright": "^1.58.0"
  }
}

• Confidence: 92% confidence
• Finding: The marked dependency is specified with a caret range, so future installs may pull in different releases than were originally tested. That weakens reproducibility and can expose the skill to supply-chain issues if a later allowed version contains a security flaw or compromised package contents.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"dependencies": {
    "js-yaml": "^4.1.0",
    "marked": "^11.0.0",
    "playwright": "^1.58.0"
  }
}

• Confidence: 94% confidence
• Finding: Playwright is also unpinned, which is more concerning than a small utility library because it brings a large browser automation stack and install-time browser components. Version drift here can change runtime behavior, expand attack surface, or introduce supply-chain issues in a component that interacts with web content and local execution contexts.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# 小红书笔记创作技能依赖

# Markdown 处理
markdown>=3.4.0
PyYAML>=6.0

# 浏览器自动化（渲染图片）

• Confidence: 97% confidence
• Finding: Using a lower-bound specifier like markdown>=3.4.0 leaves builds non-reproducible and can silently pull in future vulnerable or breaking releases. In a content-generation skill that may process user-supplied Markdown, dependency drift increases the chance of introducing parser-related denial-of-service or security issues without review.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# Markdown 处理
markdown>=3.4.0
PyYAML>=6.0

# 浏览器自动化（渲染图片）
playwright>=1.40.0

• Confidence: 99% confidence
• Finding: PyYAML is security-sensitive because unsafe loading patterns can lead to deserialization risks, and an unpinned version allows unexpected upgrades to vulnerable or incompatible releases. Given this skill likely ingests configuration or structured content, dependency uncertainty materially raises risk.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

PyYAML>=6.0

# 浏览器自动化（渲染图片）
playwright>=1.40.0

# 小红书发布
xhs>=0.4.0

• Confidence: 95% confidence
• Finding: playwright>=1.40.0 permits unreviewed future versions, which can change browser automation behavior and introduce new security or supply-chain issues. Because this skill renders images via browser automation, dependency drift affects a component that processes dynamic content and interacts with a browser engine.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

playwright>=1.40.0

# 小红书发布
xhs>=0.4.0

# 环境变量管理
python-dotenv>=1.0.0

• Confidence: 96% confidence
• Finding: The xhs package appears central to posting content to Xiaohongshu and likely handles authentication, requests, and publishing logic. Leaving it unpinned increases supply-chain and integrity risk for a package with direct access to account actions and possibly credentials.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

xhs>=0.4.0

# 环境变量管理
python-dotenv>=1.0.0

# HTTP 请求（API 模式）
requests>=2.28.0

• Confidence: 94% confidence
• Finding: python-dotenv manages environment configuration, often including secrets, and an unpinned dependency can introduce vulnerabilities or unexpected behavior changes in secret handling. While not immediately exploitable on its own, it weakens deployment integrity and can amplify other misconfigurations.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

python-dotenv>=1.0.0

# HTTP 请求（API 模式）
requests>=2.28.0

• Confidence: 98% confidence
• Finding: requests is a security-critical networking library, and requests>=2.28.0 allows installation of versions with newly introduced flaws or behavioral changes affecting redirects, TLS, proxies, or credential handling. Since this skill may call external APIs and publish content, insecure or drifting HTTP behavior can directly impact confidentiality and integrity.

Known Vulnerable Dependency: js-yaml==4.1.0 — 1 advisory(ies): CVE-2025-64718 (js-yaml has prototype pollution in merge (<<))

Low

• Category: Supply Chain
• Confidence: 87% confidence
• Finding: js-yaml 4.1.0 is flagged for prototype pollution in merge keys (<<), which can let attacker-controlled YAML modify object prototypes when unsafe parsing patterns are used. In a content-creation skill that may ingest user-provided materials or metadata, this becomes more relevant because YAML front matter or config-like inputs are plausible, and polluted objects can lead to logic corruption or secondary exploitation.

Known Vulnerable Dependency: markdown — 2 advisory(ies): CVE-2025-69534 (Python-Markdown has an Uncaught Exception); CVE-2025-69534 (Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like se)

High

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: The dependency list permits installation of markdown versions flagged by advisories, and the requirement does not constrain away affected releases. In a skill that likely parses or renders Markdown from user-provided content, a parser exception bug can be abused for denial of service or content-processing failures.

Known Vulnerable Dependency: PyYAML — 8 advisory(ies): CVE-2019-20477 (Deserialization of Untrusted Data in PyYAML); CVE-2020-1747 (Improper Input Validation in PyYAML); CVE-2020-14343 (Improper Input Validation in PyYAML) +5 more

Critical

• Category: Supply Chain
• Confidence: 99% confidence
• Finding: PyYAML has a long history of unsafe deserialization issues, and the requirement PyYAML>=6.0 does not prove the code avoids vulnerable usage patterns or affected versions. If this skill loads YAML from user-controlled or semi-trusted sources, exploitation could lead to arbitrary code execution or serious compromise depending on how loaders are used.

Known Vulnerable Dependency: python-dotenv — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low

• Category: Supply Chain
• Confidence: 78% confidence
• Finding: The advisory against python-dotenv concerns symlink-following behavior in set_key, which is only exploitable if the skill invokes that API on attacker-influenced paths. The requirements entry allows potentially affected versions, so this is a real dependency risk, though its practical impact depends on whether write-back of .env files occurs.

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High

• Category: Supply Chain
• Confidence: 96% confidence
• Finding: The requests dependency is associated with multiple advisories, and the broad version specifier may resolve to affected releases. In a skill that makes HTTP/API calls and may handle authentication for publishing, issues such as credential leakage, redirect mishandling, or TLS/state problems can expose secrets or enable request forgery-style abuse.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.