Baoyu Post To Xhs

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:19 AM UTC
• Version: 1.2.0

Overview

The skill does what it says, but it has review-worthy risks around browser control, unpinned runtime execution, automatic Chrome process termination, and sensitive page diagnostics.

Install only if you are comfortable giving the skill access to an authenticated Xiaohongshu browser profile and local posting assets. Prefer using a preinstalled trusted Bun runtime, avoid --submit unless you intend immediate public posting, avoid --debug/probe scripts on sensitive pages, and do not let it automatically kill Chrome CDP processes without reviewing what will be stopped.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:26
• Finding: Unpinned Remote Runtime Package Is Automatically Downloaded and Executed<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:26-31`, `SKILL.md:88-92` **Vulnerability Type**: Unpinned package execution through `npx` **Risk Level**: High ### Vulnerable Code ```markdown **Agent Execution Instructions**: 1. Determine this SKILL.md file's directory path as `{baseDir}` 2. Script path = `{baseDir}/scripts/<script-name>.ts` 3. Replace all `{baseDir}` in this document with the actual path 4. Resolve `${BUN_X}` runtime: if `bun` installed → `bun`; if `npx` available → `npx -y bun`; else suggest installing bun ``` ```bash ${BUN_X} {baseDir}/scripts/check-permissions.ts ``` ### Technical Analysis When Bun is unavailable, the instructions direct the agent to run `npx -y bun`. No package version or integrity digest is specified. Consequently, `npx` may retrieve the currently published `bun` package and execute its package entry point with the permissions of the invoking user. The effective runtime payload can therefore change after the Skill has been reviewed. The local lockfile does not mitigate this behavior because it only locks the vendored `baoyu-chrome-cdp` dependency and does not pin the package selected by the standalone `npx -y bun` command. This is an unsafe supply-chain execution path. Exploitation depends on compromise or malicious control of the resolved registry package, registry configuration, network resolution, or package source. ### Attack Path 1. Bun is not installed, but `npx` is available. 2. The agent follows the Skill instruction and resolves `${BUN_X}` to `npx -y bun`. 3. `npx` queries the configured package registry for the unpinned `bun` package. 4. A compromised package, registry, mirror, or resolution path supplies attacker-controlled code. 5. `npx` downloads and executes that code without an interactive installation confirmation because of `-y`. 6. The payload runs with the same filesystem, network, environment-variable, and process privileges as the agent. ### Impact Assessment Successful exploi ...[truncated 401 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not automatically execute an unversioned package through `npx -y`. 2. Require a preinstalled, trusted Bun executable and fail safely when it is unavailable. 3. If automatic acquisition is unavoidable, pin an audited version rather than resolving the latest release. 4. Verify the downloaded artifact using a trusted cryptographic digest or signed release mechanism. 5. Pin the package registry to a trusted source and document the expected package provenance. 6. Avoid `-y` for security-sensitive runtime installation so the user can review the package and version. 7. Prefer distributing the scripts in a form executable by an already trusted local runtime. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:183
• Finding: Recovery Instructions Can Terminate Unrelated Chrome Debugging Sessions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:183-195` **Vulnerability Type**: Overbroad process termination without user confirmation **Risk Level**: Medium ### Vulnerable Code ```markdown If a script fails with `Chrome debug port not ready`, kill existing Chrome CDP instances first, then retry: ```bash pkill -f "Chrome.*remote-debugging-port" 2>/dev/null; sleep 2 ``` ```powershell # PowerShell (Windows) Get-Process chrome -ErrorAction SilentlyContinue | Where-Object { $_.CommandLine -match 'remote-debugging-port' } | Stop-Process -Force Start-Sleep -Seconds 2 ``` **Important**: This should be done automatically — when encountering this error, kill Chrome CDP instances and retry the command without asking the user. ``` ### Technical Analysis The Unix command selects processes by a broad command-line regular expression rather than by a PID created and tracked by this Skill. The Windows command similarly terminates every Chrome process whose command line contains `remote-debugging-port`. These selectors are not restricted to the Skill's dedicated profile directory, selected debugging port, current process tree, or a recorded child PID. They can therefore match unrelated browser automation, developer tools, testing sessions, or other Skills using Chrome CDP. The instruction explicitly requires automatic execution without obtaining user consent, exceeding the minimum privileges needed to launch or reconnect to the Skill's own Chrome instance. ### Attack Path 1. The Skill encounters or reports `Chrome debug port not ready`. 2. The agent follows the mandatory troubleshooting instruction without asking the user. 3. The agent runs the supplied `pkill` or PowerShell process-termination command. 4. The broad process match identifies all qualifying Chrome CDP instances owned by the user, including unrelated instances. 5. Those processes are terminated, after which the Skill retries its operation. ### Impact Assessment This can terminate unre ...[truncated 328 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Record the PID of every Chrome process launched by the Skill. 2. Terminate only the recorded child process and its verified descendants. 3. Verify that the process uses the exact Skill-owned profile directory and expected debugging port before termination. 4. Do not use global `pkill -f` or process-wide PowerShell matching as an automatic recovery action. 5. If an existing browser was reused rather than launched by the Skill, disconnect from CDP instead of terminating it. 6. Require explicit user confirmation before stopping any process not demonstrably owned by the current Skill invocation. 7. Prefer retrying with a newly allocated local port and a separate profile over terminating external processes. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/xhs-utils.ts:57
• Finding: Shell Command Injection in WSL Profile Path Conversion<![CDATA[ ## Vulnerability Details **File Location**: `scripts/xhs-utils.ts:57-65` **Vulnerability Type**: OS command injection through unsafe string interpolation **Risk Level**: High ### Vulnerable Code ```ts function getWslWindowsHome(): string | null { if (_wslHome !== undefined) return _wslHome; if (!process.env.WSL_DISTRO_NAME) { _wslHome = null; return null; } try { const raw = execSync('cmd.exe /C "echo %USERPROFILE%"', { encoding: 'utf-8', timeout: 5000 }).trim().replace(/\r/g, ''); _wslHome = execSync(`wslpath -u "${raw}"`, { encoding: 'utf-8', timeout: 5000 }).trim() || null; } catch { _wslHome = null; } return _wslHome; } ``` ### Technical Analysis `execSync()` executes its string argument through a shell. The value returned by `cmd.exe` is inserted directly into a second shell command: ```ts execSync(`wslpath -u "${raw}"`, ...) ``` Quoting the value with double quotes is not sufficient shell escaping. If `raw` contains a double quote followed by shell metacharacters or command substitution syntax, it can terminate or modify the intended argument and introduce an additional shell command. The dangerous value originates from `%USERPROFILE%`. Exploitation therefore requires an attacker to influence the inherited Windows environment or the output of the invoked `cmd.exe`, such as through a compromised execution environment or attacker-controlled launcher. Under that precondition, resolving the default Chrome profile path can trigger arbitrary command execution. ### Attack Path 1. The Skill runs inside WSL with `WSL_DISTRO_NAME` present. 2. An attacker controls or influences the Windows `USERPROFILE` value returned to the process, or otherwise controls the output produced by the resolved `cmd.exe`. 3. The malicious value contains characters that escape the double-quoted `wslpath` argument and append a shell command. 4. `getDefaultProfileDir()` calls `getWslWindowsHome()`. 5. `execSync()` passes the interpolated command string t ...[truncated 491 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Never construct shell commands by interpolating external data into a command string. 2. Replace the second `execSync()` call with an argument-array API that does not invoke a shell, for example: ```ts import { execFileSync } from 'node:child_process'; _wslHome = execFileSync( 'wslpath', ['-u', raw], { encoding: 'utf-8', timeout: 5000 } ).trim() || null; ``` 3. Alternatively, use `spawnSync('wslpath', ['-u', raw], { shell: false, ... })` and validate its status. 4. Resolve `cmd.exe` from a trusted absolute path where practical to reduce executable search-path manipulation. 5. Validate that the returned profile path has the expected Windows path format before passing it to another process. 6. Reject control characters, line breaks, NUL bytes, and unexpected path formats. 7. Add tests containing quotes, dollar signs, backticks, semicolons, command substitutions, and line breaks. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (29)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: General Chrome discovery, reuse of arbitrary remote-debugging sessions, arbitrary CDP command capability, and enabling Runtime/DOM/Network domains are materially broader than posting to Xiaohongshu. This effectively grants a browser-control primitive that could inspect or manipulate unrelated tabs, traffic, and authenticated contexts if misused or if the skill is invoked unexpectedly.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: General Chrome discovery, reuse of arbitrary remote-debugging sessions, arbitrary CDP command capability, and enabling Runtime/DOM/Network domains are materially broader than posting to Xiaohongshu. This effectively grants a browser-control primitive that could inspect or manipulate unrelated tabs, traffic, and authenticated contexts if misused or if the skill is invoked unexpectedly.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: General Chrome discovery, reuse of arbitrary remote-debugging sessions, arbitrary CDP command capability, and enabling Runtime/DOM/Network domains are materially broader than posting to Xiaohongshu. This effectively grants a browser-control primitive that could inspect or manipulate unrelated tabs, traffic, and authenticated contexts if misused or if the skill is invoked unexpectedly.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: General Chrome discovery, reuse of arbitrary remote-debugging sessions, arbitrary CDP command capability, and enabling Runtime/DOM/Network domains are materially broader than posting to Xiaohongshu. This effectively grants a browser-control primitive that could inspect or manipulate unrelated tabs, traffic, and authenticated contexts if misused or if the skill is invoked unexpectedly.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: General Chrome discovery, reuse of arbitrary remote-debugging sessions, arbitrary CDP command capability, and enabling Runtime/DOM/Network domains are materially broader than posting to Xiaohongshu. This effectively grants a browser-control primitive that could inspect or manipulate unrelated tabs, traffic, and authenticated contexts if misused or if the skill is invoked unexpectedly.

Ae1

High

• Category: analysis-evasion

Content

| `scripts/check-permissions.ts` | Verify environment & permissions |

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill explicitly instructs execution of local scripts that use environment variables, browser automation, and networked browser/CDP access, yet it declares no tool scope or permission boundaries. This makes the skill under-specified from a security perspective and increases the risk that an agent will grant broader capabilities than users expect.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 83% confidence
• Finding: Using `npx -y bun` without a pinned version allows fetching whatever package/version is current at execution time, creating a supply-chain risk and undermining reproducibility. If the upstream package is compromised or behavior changes, the skill may execute unexpected code on the user's machine.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

Start-Sleep -Seconds 2
```

**Important**: This should be done automatically — when encountering this error, kill Chrome CDP instances and retry the command without asking the user.

## Notes

• Confidence: 87% confidence
• Finding: The directive to kill Chrome CDP instances and retry 'without asking' authorizes autonomous destructive action affecting local processes. Even if intended as convenience, removing the consent step is unsafe because it can impact unrelated browser automation and violate the user's expectations about control over their environment.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The instruction to automatically terminate Chrome CDP processes is broader than the stated purpose and can disrupt other active automation, browser sessions, or user workflows. In shared or multi-task environments, indiscriminate process killing can cause data loss or break unrelated tasks.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Including destructive process-kill instructions without an explicit warning deprives the user of informed consent and can unexpectedly close sessions or discard unsaved work. The danger is amplified because the command pattern may match broader Chrome/CDP usage than this single skill instance.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The code extracts outerHTML from the upload area and prints it, which can expose hidden values, internal identifiers, embedded text, or other sensitive DOM content from the authenticated Xiaohongshu page. Because it operates against an attached existing browser session, the risk is higher than generic scraping: it can leak user-specific data from a live account into logs or downstream systems.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script attaches to an existing logged-in Chrome session, reads all visible text from the Xiaohongshu creator page, and prints it to stdout. Visible page text can include account information, draft content, business data, or other sensitive information, and emitting it to logs creates an unnecessary data exposure channel outside the browser context.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: This script connects to a live Chrome debugging session and prints DOM structure plus an outerHTML snippet from the active Xiaohongshu creator page. Even though it is framed as a diagnostic probe, those logs can expose user content, draft text, account-specific metadata, or other sensitive on-page information to terminal history, CI logs, or other observers without any warning or minimization.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: This probe script uses Chrome DevTools Runtime.evaluate to enumerate and print broad page data, including visible text, button labels, file input metadata, and chunks of HTML from the Xiaohongshu creator page. In a logged-in browser context, those debug dumps can capture account-specific or sensitive content unrelated to the minimum data needed for posting, and may leak it into console logs, CI logs, or agent telemetry.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: The script relies throughout on fixed Chinese strings such as `上传图文`, `上传照片`, `发布`, and the usage examples are likewise Chinese-specific. This effectively forces a single locale and may fail or behave unpredictably for users whose browser/account language differs, without any user opt-in or documented locale constraint.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: When `submit` is enabled, the script programmatically clicks the live publish button and waits for confirmation without requiring an execution-time confirmation from the operator. In an agent skill context, this increases the chance of unintended public posting, reputational damage, accidental disclosure of sensitive content, or irreversible publication triggered by prompt misunderstanding or automation errors.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/check-permissions.ts:40

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/vendor/baoyu-chrome-cdp/src/index.ts:220

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/xhs-utils.ts:61

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/vendor/baoyu-chrome-cdp/src/index.ts:97