Security audit

Xiaohongshu Search Summarizer

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it advertises, but its local file-writing and scraped-content handling need review before installation.

Install only if you are comfortable with a headed browser scraping Xiaohongshu, storing posts/comments/images locally, and writing reports to disk. Use a dedicated output directory, avoid keywords containing path separators, do not run it with elevated privileges, and treat all scraped text and images as untrusted source material.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/parse.py:54
Finding: Path Traversal Through Unsanitized Keyword-Based Filename
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/run.sh:20
Finding: Predictable Temporary File Allows Symlink-Based File Overwrite
Content: View full analysis
"$SCRIPT_PATH" async page => { ``` Cleanup occurs only at the end of a successful execution path: ```bash rm -f "$SCRIPT_PATH" ``` ### Technical Analysis The temporary JavaScript pathname consists of a fixed prefix and the shell process ID. Process identifiers are predictable, and the script creates the file using ordinary shell redirection. Shell redirection follows symbolic links and does not provide exclusive creation semantics. A local attacker able to write to `/tmp` can attempt to pre-create the predicted pathname as a symbolic link to another file. When the heredoc redirection opens the pathname, the linked target can be truncated and overwritten with the generated Playwright code. Cleanup is also not registered through a signal or exit trap. If `playwright-cli`, Python, or the shell terminates unexpectedly, the generated script may remain in the shared temporary directory. ### Attack Path 1. A local attacker predicts or observes the process ID that will execute `run.sh`. 2. The attacker creates `/tmp/xhs_scrape_.js` as a symbolic link to a file writable by the victim process. 3. The Skill executes the heredoc redirection into the predictable pathname. 4. The operating system follows the symbolic link. 5. The linked target is truncated and overwritten using the privileges of the Skill process. 6. If execution terminates before the final cleanup statement, the temporary artifact may remain available. ### Impact Assessment The attacker can overwrite files that are writable by the account running the Skill. No privilege escalation occurs unless the Skill itself runs with elevated privileges, but under such execution the overwrite scope increases accordingly. Exploita ...[truncated 117 chars]
Remediation: View remediation
"$SCRIPT_PATH" async page => { // Playwright code } EOF ``` ]]>

T01 · Skill Instruction Hijacking

Warning

Location: scripts/parse.py:70
Finding: Indirect Prompt Injection Through Untrusted Scraped Content
Content: View full analysis
{line}\n" output_md += "\n" comments = post.get("comments", []) if comments: output_md += "**💬 Top 评论：**\n" for c in comments: user = c.get("user", "User") content = c.get("content", "").replace('\n', ' ') output_md += f"- **{user}**: {content}\n" output_md += "\n" ``` The Skill then requires the agent to ingest that generated file: ```markdown 5. **You** MUST use your file reading capabilities to read the `[keyword]_raw_data.md` file. 6. Inside the raw data markdown, you will find paths to image files. **You MUST use your file reading / vision capabilities on these image file paths** to actually ingest and "see" their visual content. 7. **You** analyze the texts, summarize the genuinely useful comments... ``` ### Technical Analysis Post titles, descriptions, usernames, and comments originate from external Xiaohongshu users and are therefore attacker-controlled. The parser embeds those values directly into a Markdown document without establishing a trust boundary or encoding them as inert structured data. The Skill instructions explicitly require an AI agent to read the generated document and associated images. Consequently, malicious content such as instructions to ignore the user, disclose data, ...[truncated 1599 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/parse.py:93
Finding: Unbounded and Unvalidated Image Downloads
Content: View full analysis
Remediation: View remediation
MAX_IMAGE_BYTES: raise ValueError("Image exceeds the size limit") img_f.write(chunk) ``` ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: This second mismatch finding is also substantively valid because the skill delegates key behavior to wrapper/parser scripts and local artifact handling that are not transparently represented in the declared purpose. Such under-disclosure can mask persistence, external execution, and broader data collection than a user expects from a simple summarization skill.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: This second mismatch finding is also substantively valid because the skill delegates key behavior to wrapper/parser scripts and local artifact handling that are not transparently represented in the declared purpose. Such under-disclosure can mask persistence, external execution, and broader data collection than a user expects from a simple summarization skill.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill explicitly directs use of file reading, file writing, network access, and browser-driven extraction, but it does not declare any tool scope or permission boundaries. This increases the blast radius if the skill is invoked unexpectedly or modified later, because an agent may exercise broader capabilities than a reviewer or user would infer from the metadata.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The invocation text is broad enough to match generic research or summarization requests, which could cause this skill to run in situations where Xiaohongshu scraping, browser automation, and file creation are unnecessary. Overbroad triggering is dangerous because it can expand data collection and external interaction beyond user intent, even without overtly malicious code.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs downloading images from remote sources into a local directory without clearly warning about persistent local file creation, storage volume, or retention. This can lead to unanticipated disk usage, storage of potentially sensitive or copyrighted content, and residual artifacts remaining after the task completes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill tells the agent to save a synthesized markdown report into the output directory using file-writing capabilities, but it does not warn about file creation or overwriting behavior. Unannounced writes can alter local state, clobber existing files, or leave sensitive summaries on disk where users do not expect them.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The generated report title is hard-coded in Chinese, which imposes a specific language on all users regardless of their preferences. This is a natural-language policy issue because the file does not offer a language choice or explain that the skill is intentionally limited to a Chinese-only regional context.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The script saves scraped data to xhs_data.json and then invokes a parser that processes artifacts, while the collected payload includes titles, descriptions, image URLs, and comments. Although there is basic status logging, there is no user-facing warning that the operation collects and stores third-party content that may include personal data.
Content: No source excerpt is available for this finding.