Xhs Publish

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:24 AM UTC
• Version: 1.4.5

Overview

This skill matches its Xiaohongshu publishing purpose, but it handles sensitive keys/cookies and runs unverified background publishing software, so it should be reviewed carefully before installation.

Install only if you are comfortable letting this skill automate a live Xiaohongshu account. Do not paste API keys or browser cookies into chat; configure secrets out of band and rotate any exposed key. Avoid the documented latest downloads unless you can pin and verify the MCP binary/package, and require a final explicit confirmation before any live post.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (6)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:1104
• Finding: Unverified Mutable Remote Binary Is Downloaded and Executed<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:1104-1110` **Additional Locations**: `SKILL.md:982-983`, `README.md:134-142`, `README.html:754-760` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```bash mkdir -p ~/xiaohongshu-mcp && cd ~/xiaohongshu-mcp wget https://github.com/xpzouying/xiaohongshu-mcp/releases/latest/download/xiaohongshu-mcp-linux-amd64.tar.gz tar xzf xiaohongshu-mcp-linux-amd64.tar.gz chmod +x xiaohongshu-* export ROD_DEFAULT_TIMEOUT=10m DISPLAY=:99 nohup ./xiaohongshu-mcp-linux-amd64 -port :18060 > mcp.log 2>&1 & ``` ### Technical Analysis The installation instructions retrieve a native executable from the mutable `latest` release of a personal GitHub repository. The archive is neither cryptographically signed nor checked against an expected digest before extraction and execution. Because the `latest` reference can resolve to different content after this Skill has been audited, the effective executable payload is outside the reviewed artifact and can change without a corresponding Skill update. The wildcard command `chmod +x xiaohongshu-*` also grants executable permission to every matching extracted file instead of only one validated binary. Although an MCP component is relevant to publishing, downloading and immediately running an unverified native executable is not the minimum safe privilege model for that functionality. ### Attack Path 1. An attacker compromises the upstream GitHub account, release workflow, repository credentials, or release asset. 2. The attacker replaces or republishes the asset referenced by the mutable `latest` URL. 3. A user or Agent follows the documented installation procedure. 4. The malicious archive is extracted without archive-entry validation or integrity verification. 5. Matching files are made executable. 6. The downloaded binary is launched with `nohup` under the installing user's account. 7. The process can access file ...[truncated 447 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace `latest` with a reviewed, immutable release version. 2. Publish and verify a trusted SHA-256 digest before extraction. 3. Require a verifiable release signature from a documented maintainer key. 4. Download to a private temporary directory and abort on any verification failure. 5. Inspect archive entries before extraction and reject absolute paths, symbolic-link escapes, and `../` traversal. 6. Grant executable permission only to the exact expected file. 7. Run the MCP process in a restricted container or sandbox with narrowly scoped filesystem and network access. 8. Avoid inheriting unrelated environment secrets. 9. Document the upstream trust relationship and provide reproducible build instructions. ]]>

T08 · Insecure Dependencies

Error

• Location: SKILL.md:488
• Finding: Unpinned Packages Are Automatically Downloaded and Executed<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:488-498` **Additional Locations**: `SKILL.md:558-581`, `README.md:117-118`, `README.html:608` **Vulnerability Type**: Unsafe and mutable third-party dependency execution **Risk Level**: High ### Vulnerable Code ```bash source /etc/environment && timeout 120 npx -y md2card-mcp-server@latest << 'EOFMCP' {"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"openclaw","version":"1.0.0"}}} {"jsonrpc":"2.0","method":"notifications/initialized"} {"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"md2card_api","arguments":{ "markdown": "## Title\n\nContent...", "type": "Xiaohongshu", "theme": "apple-notes", "splitMode": "autoSplit" }}} EOFMCP ``` Other documented execution forms include: ```bash npm install -g md2card-mcp-server@latest MD2CARD_API_KEY="your-key" npx -y md2card-mcp-server@latest & ``` ### Technical Analysis The Skill invokes `npx -y` against the mutable `latest` package version. This silently approves package retrieval and immediately executes downloaded package code. A global `npm install` alternative increases the affected scope and may execute package lifecycle scripts. The invocation at line 488 first sources `/etc/environment`. Consequently, the third-party package inherits all exported variables from that file rather than only the credential required for MD2Card. An upstream compromise could therefore expose unrelated credentials. The Skill does not pin an exact package version, provide a lockfile or integrity value, disable lifecycle scripts, or isolate execution. ### Attack Path 1. An attacker compromises the package maintainer account, registry publication credentials, or package supply chain. 2. A malicious version is published under the `latest` tag. 3. The Skill runs `npx -y md2card-mcp-server@latest`. 4. The package is downloaded and executed without interactive review. 5. In ...[truncated 568 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin an exact reviewed package version rather than using `@latest`. 2. Commit a lockfile containing registry integrity metadata. 3. Verify package provenance and integrity before execution. 4. Avoid `npx -y`; install dependencies during a controlled setup phase. 5. Disable lifecycle scripts where they are unnecessary. 6. Do not source `/etc/environment`. Pass only the required variable, for example through a narrowly scoped process environment. 7. Run card generation in a restricted container with no access to unrelated secrets or user files. 8. Avoid global installation and use a project-local, reviewed dependency. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:833
• Finding: Live-Looking API Credential Is Embedded in Skill Documentation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:833-835` **Vulnerability Type**: Hardcoded secret **Risk Level**: High ### Vulnerable Code ```bash export DOUBAO_API_KEY="919ec537-6d4d-43c4-a5ce-a90a17673bbb" ``` ### Technical Analysis The Skill contains a concrete UUID-like API credential instead of an obvious placeholder. Static review cannot establish whether it remains valid, but any potentially valid credential embedded in a distributed Skill must be treated as compromised. The surrounding documentation states that the value is an environment variable stored in `/etc/environment`, which may expose it to processes that inherit the system environment. This is especially hazardous because the Skill separately runs mutable third-party package code after sourcing that file. ### Attack Path 1. An attacker downloads or views the Skill. 2. The attacker extracts the embedded API key. 3. The attacker submits requests to the associated video-generation API. 4. If the key is active, requests consume the account's quota or incur charges. 5. If users store the key in `/etc/environment`, unrelated or compromised processes may also inherit it. ### Impact Assessment Potential impact includes unauthorized paid API usage, quota exhaustion, financial loss, and suspension of the associated provider account. The credential itself does not grant operating-system privileges, but it may authorize external service operations billed to the credential owner. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Revoke or rotate the exposed credential immediately. 2. Replace the value with an unmistakable placeholder such as `YOUR_DOUBAO_API_KEY`. 3. Scan repository history and distributed artifacts for the same credential. 4. Load credentials from a protected secret manager or narrowly scoped runtime prompt. 5. Do not store service credentials in `/etc/environment`. 6. Restrict replacement credentials by API, account, quota, and source where the provider supports such controls. 7. Enable provider-side usage alerts and review historical activity for abuse. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/generate.sh:106
• Finding: Configurable API Endpoint Can Receive Bearer Credentials and Private Content Without Validation<![CDATA[ ## Vulnerability Details **File Location**: `scripts/generate.sh:106-109` **Additional Location**: `scripts/generate.sh:136-139` **Vulnerability Type**: Unvalidated sensitive-data destination **Risk Level**: High ### Vulnerable Code ```bash RESULT=$(curl -s -X POST "$API_URL" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $API_KEY" \ -d "$PAYLOAD") ``` The destination and credential are read directly from the environment: ```bash API_URL="${XHS_AI_API_URL:-}" API_KEY="${XHS_AI_API_KEY:-}" MODEL="${XHS_AI_MODEL:-}" ``` ### Technical Analysis The script accepts any value in `XHS_AI_API_URL` and sends both the configured bearer credential and user-supplied content to that endpoint. It does not require HTTPS, restrict destinations to known providers, reject redirects, or verify that a credential belongs to the selected host. The custom endpoint is documented as a user-controlled feature, so this is not evidence of a fixed attacker-operated destination. Nevertheless, a malicious environment configuration, configuration injection, typographical error, or insecure HTTP URL can redirect sensitive data outside the intended provider. ### Attack Path 1. An attacker or compromised setup process modifies `XHS_AI_API_URL` to point to an attacker-controlled server. 2. The user invokes `generate.sh` with private draft content. 3. The script constructs a payload containing that content. 4. `curl` sends the payload and `Authorization: Bearer` header to the configured server. 5. The attacker records the credential and content. 6. The attacker reuses the credential against the legitimate API, if compatible. ### Impact Assessment The issue can disclose the configured AI API key and all content submitted for title or body generation. This may include confidential drafts, personal data, product plans, or unpublished marketing content. Credential reuse may permit unauthorized API calls and financial quota abuse. The script itself does not ...[truncated 49 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require an `https://` endpoint and reject all other schemes. 2. Maintain an allowlist of supported provider hostnames. 3. Refuse URLs containing embedded credentials, unexpected ports, or local/internal addresses unless explicitly required. 4. Disable redirects with `--max-redirs 0`, or validate every redirect destination before forwarding credentials. 5. Use `curl --fail --show-error --proto '=https'`. 6. Associate each credential with a specific provider instead of forwarding one generic key to arbitrary hosts. 7. Require explicit user confirmation before sending content to a custom endpoint. 8. Warn users that prompts and drafts are transmitted to the selected external provider. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: check_env.sh:17
• Finding: Environment Check Silently Starts System Services and Background Processes<![CDATA[ ## Vulnerability Details **File Location**: `check_env.sh:17-54` **Invocation Location**: `SKILL.md:958-963` **Vulnerability Type**: Least-privilege violation and unexpected state-changing behavior **Risk Level**: Medium ### Vulnerable Code ```bash if systemctl is-active --quiet xvfb 2>/dev/null; then echo "Xvfb service is running" elif pgrep -x Xvfb > /dev/null; then echo "Xvfb is running manually" else echo "Xvfb is not running; attempting to start the systemd service..." systemctl start xvfb 2>/dev/null sleep 1 if systemctl is-active --quiet xvfb 2>/dev/null; then echo "Xvfb service started" else echo "The systemd service does not exist; starting manually..." Xvfb :99 -screen 0 1920x1080x24 & sleep 1 echo "Xvfb started without a service manager" fi fi if systemctl is-active --quiet xhs-mcp 2>/dev/null; then echo "MCP service is running" elif pgrep -f xiaohongshu-mcp-linux > /dev/null; then echo "MCP service is running manually" else echo "MCP service is not running; attempting to start the systemd service..." systemctl start xhs-mcp 2>/dev/null sleep 2 if systemctl is-active --quiet xhs-mcp 2>/dev/null; then echo "MCP service started" else echo "The systemd service does not exist; starting manually..." cd ~/xiaohongshu-mcp && DISPLAY=:99 nohup ./xiaohongshu-mcp-linux-amd64 > mcp.log 2>&1 & sleep 3 fi fi ``` ### Technical Analysis The file is named and documented as an environment check, but it is not read-only. If Xvfb or the MCP service is absent, it attempts to start systemd units and then falls back to launching persistent background processes. Starting these components is related to publishing, but combining state changes with diagnostics violates the principle of least surprise and exceeds the minimum privilege needed to report environment status. This is particularly significant because the MCP binary is obtained through the unverified download process described elsewh ...[truncated 1090 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Make `check_env.sh` strictly read-only. 2. Move all startup behavior into a separate, clearly named script or command. 3. Require explicit user confirmation before starting services or background processes. 4. Validate the MCP binary's version, ownership, permissions, signature, and digest before execution. 5. Do not silently fall back from a service check to `nohup`. 6. Use a restricted service account or sandbox for the MCP process. 7. Report missing services as actionable errors instead of changing system state. 8. If systemd integration is supported, document and audit the exact unit definition and its privilege restrictions. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:656
• Finding: Skill Instructs Users to Send API Secrets Through Chat<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:656-665` **Vulnerability Type**: Insecure credential handling **Risk Level**: Medium ### Vulnerable Code ```text If MCP is not configured, tell the user to install it: MD2Card MCP is a required component. Install it first: 1. Visit https://md2card.cn/zh/login to obtain an API key 2. Copy the API key 3. Send it to me in this format: MD2CARD_API_KEY=sk-xxx 4. I will automatically configure the environment variable ``` ### Technical Analysis The workflow directs the user to disclose an API credential directly in the conversation. Chat messages may be retained in conversation history, Agent context, telemetry, backups, or external logging systems. The Skill also promises to configure the environment variable automatically but does not define a secure storage mechanism, retention period, access controls, redaction policy, or deletion procedure. An API key should not be collected through ordinary conversational content when a protected local secret-entry mechanism is available. ### Attack Path 1. The Agent reports that MD2Card is not configured. 2. The user follows the Skill's instructions and posts the API key into the chat. 3. The secret becomes part of the conversation transcript and Agent context. 4. Any service, operator, extension, log processor, or compromised component with transcript access can obtain the key. 5. The key may then be reused to generate paid cards or access account information exposed by the provider API. ### Impact Assessment The primary impact is disclosure of the user's MD2Card credential. An exposed key may permit unauthorized API use, quota consumption, paid generation, or access to account metadata, depending on provider-side permissions. The issue does not directly grant local operating-system privileges. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove all instructions asking users to paste API keys into chat. 2. Use a protected local secret prompt, operating-system keychain, or dedicated secret manager. 3. Pass the secret only to the process that requires it. 4. Never echo the credential in command output or logs. 5. Document where the secret is stored, which processes can read it, and how users can revoke or delete it. 6. Redact credential-shaped strings from telemetry and error messages. 7. Recommend provider-side scope restrictions, quota limits, and periodic rotation. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (82)

Hidden Instructions

High

• Category: Prompt Injection

Content

</style>
</head>
<body>
    <!-- 左侧菜单 -->
    <aside class="sidebar">
        <div class="logo">
            <h1>📕 xhs-publish Skill</h1>

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

</div>
            </div>

            <!-- 视频生成 -->
            <div id="video" class="page">
                <h2 class="page-title">视频生成</h2>

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

</div>
            </div>

            <!-- 视频生成 -->
            <div id="video" class="page">
                <h2 class="page-title">视频生成</h2>

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Chaining Abuse

High

• Category: Tool Misuse

Content

<h2 class="page-title">安装 MCP 服务</h2>

                <h3 class="page-subtitle">安装依赖</h3>
                <pre><code>sudo apt update && sudo apt install -y xvfb imagemagick zbar-tools xdotool fonts-noto-cjk</code></pre>

                <h3 class="page-subtitle">启动虚拟显示</h3>
                <pre><code>Xvfb :99 -screen 0 1920x1080x24 &</code></pre>

• Confidence: 75% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: 声明描述的是一个覆盖创意生成、文案撰写、多种内容形态生成以及最终发布的完整小红书发布流程工具。但提供的代码块只是 cover.sh，核心行为是生成封面图：校验参数、调用图像生成 API 或读取用户图片、裁剪缩放、生成标题文字底板、拼接为封面图并保存到本地。脚本确实支持多模型切换，且与“封面生成”这一子功能相符，但与声明中的主要目的相比明显不完整，也没有任何发布平台、正文创作、视频或知识卡片相关逻辑。因此描述对该代码块的能力构成了明显夸大，属于用途与实际行为不匹配。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: 声明描述的是一个从创意到上线的小红书发布全流程工具，核心能力包含内容生成、多媒体素材生成和实际发布。提供的代码块却只是一个 shell 备用脚本，分为 title 和 content 两种模式，分别通过外部聊天补全 API 生成标题或正文。代码没有任何小红书平台接口调用、浏览器自动化、上传发布逻辑，也没有图像、卡片或视频生成相关处理。因此，实际行为仅覆盖声明中的一小部分，且缺失最关键的“发布”和多媒体生成能力，属于明显的描述与行为不一致。

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The skill instructs the agent to collect user API keys and configure environment variables, which goes beyond ordinary content publishing assistance and creates a credential-handling surface. Asking users to transmit secrets in chat or allowing the agent to install them into the environment risks leakage, reuse, and unauthorized access to third-party accounts.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The skill explicitly tells users to send an API key directly in chat so the agent can configure it. Chat channels are not an appropriate secret-management interface, and secrets placed there may be retained in logs, transcripts, or downstream tooling.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The cookie-login fallback instructs collection and manual handling of browser session cookies such as `a1`, `web_session`, and `id_token`. These are highly sensitive authentication artifacts; if exposed to the agent, logs, or third parties, they can allow account takeover or session hijacking.

Ssd 3

High

• Confidence: 99% confidence
• Finding: Directing users to extract and provide authentication cookies exposes live session credentials outside the browser security boundary. These cookies can often be replayed to impersonate the user, making this a serious account-compromise risk.

Chaining Abuse

High

• Category: Tool Misuse

Content

### 8.1 安装依赖

```bash
sudo apt update && sudo apt install -y xvfb imagemagick zbar-tools xdotool fonts-noto-cjk
```

### 8.2 启动虚拟显示

• Confidence: 86% confidence
• Finding: The chained command `sudo apt update && sudo apt install` bundles multiple privileged actions into one step, which reduces opportunities for review and increases the chance of unintended execution. In an agent context, command chaining can magnify the impact of a single mistaken approval or prompt injection.

External Script Fetching

High

• Category: Supply Chain

Content

)

  echo "🔄 正在生成小红书爆款标题..."
  RESULT=$(curl -s -X POST "$API_URL" \
    -H "Content-Type: application/json" \
    -H "Authorization: Bearer $API_KEY" \
    -d "$PAYLOAD")

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

External Script Fetching

High

• Category: Supply Chain

Content

)

  echo "🔄 正在生成小红书正文..."
  RESULT=$(curl -s -X POST "$API_URL" \
    -H "Content-Type: application/json" \
    -H "Authorization: Bearer $API_KEY" \
    -d "$PAYLOAD")

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

<ol>
                    <li><strong>Seedance API Key</strong>：AI 视频生成服务，约 0.1 元/5秒<br><code>export DOUBAO_API_KEY="您的密钥"</code></li>
                    <li><strong>Edge TTS</strong>：微软语音合成，用于生成配音<br><code>npm install -g edge-tts</code> 或 <code>pip install edge-tts</code></li>
                    <li><strong>FFmpeg</strong>：视频处理工具，用于合并视频、添加配音和字幕<br><code>sudo apt install -y ffmpeg</code></li>
                </ol>

                <h3 class="page-subtitle">自动执行流程</h3>

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

<ol>
                    <li><strong>Seedance API Key</strong>：AI 视频生成服务，约 0.1 元/5秒<br><code>export DOUBAO_API_KEY="您的密钥"</code></li>
                    <li><strong>Edge TTS</strong>：微软语音合成，用于生成配音<br><code>npm install -g edge-tts</code> 或 <code>pip install edge-tts</code></li>
                    <li><strong>FFmpeg</strong>：视频处理工具，用于合并视频、添加配音和字幕<br><code>sudo apt install -y ffmpeg</code></li>
                </ol>

                <h3 class="page-subtitle">自动执行流程</h3>

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README explicitly instructs the agent to publish immediately after content confirmation without an additional warning or explicit consent step for the account-impacting action. In a skill that automates posting to a real social-media account, this increases the risk of unintended publication, reputational damage, or accidental posting to the wrong account.

External Transmission

Medium

• Category: Data Exfiltration

Content

<h4>获取二维码</h4>
                <pre><code>MCP_URL="http://localhost:18060/mcp"
SESSION_ID=$(curl -s -D /tmp/headers -X POST "$MCP_URL" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","method":"initialize","params":{}},"id":1}' \
  > /dev/null && grep -i 'Mcp-Session-Id' /tmp/headers | awk '{print $2}')

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

<h4>获取二维码</h4>
                <pre><code>MCP_URL="http://localhost:18060/mcp"
SESSION_ID=$(curl -s -D /tmp/headers -X POST "$MCP_URL" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","method":"initialize","params":{}},"id":1}' \
  > /dev/null && grep -i 'Mcp-Session-Id' /tmp/headers | awk '{print $2}')

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

-d '{"jsonrpc":"2.0","method":"initialize","params":{}},"id":1}' \
  > /dev/null && grep -i 'Mcp-Session-Id' /tmp/headers | awk '{print $2}')

curl -s --max-time 30 -X POST "$MCP_URL" \
  -H "Mcp-Session-Id: $SESSION_ID" \
  -d '{"jsonrpc":"2.0","method":"tools/call","params":{"name":"get_login_qrcode","arguments":{}},"id":2}'</code></pre>

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The cookie-login instructions tell users to extract and copy live session cookies such as a1 and web_session, but provide no warning that these are sensitive authentication credentials. Exposure of these values would allow account takeover or session hijacking until the session expires or is revoked.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The introduction presents the skill as a convenient publishing assistant but does not prominently warn that it can automatically post to a live Xiaohongshu account. Users may underestimate the consequences of invoking it, leading to unintended publication, reputational harm, or posting under the wrong account.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger example uses very broad natural-language phrasing like '帮我发个小红书', which can cause accidental invocation during ordinary conversation. Because this skill can generate and publish directly to a live social-media account, ambiguous activation materially increases the risk of unintended posting and account misuse.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The additional examples repeat generic trigger wording without scope limits, reinforcing that common conversational text is sufficient to activate the automation. In the context of a tool that can automatically publish content, this makes unintentional execution more dangerous than in a read-only or offline skill.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The video-note example shows activation from ordinary text split across multiple lines, suggesting the skill may trigger on loosely structured conversation rather than a clear command. For a skill that performs multi-step content generation and publication, this broad matching increases the chance of accidental execution from unrelated chat context.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The credential setup section instructs users to export API keys and secrets but provides no warning about secure storage, shell history exposure, process visibility, or least-privilege handling. This can lead to credential leakage and unauthorized use of third-party APIs or publishing infrastructure.

Static analysis

No suspicious patterns detected.