ClawHub
Back to skill

Security audit

Xhs Publish

Security checks for vulnerabilities and agentic risk

Overview

This skill matches its Xiaohongshu publishing purpose, but it handles sensitive keys/cookies and runs unverified background publishing software, so it should be reviewed carefully before installation.

Install only if you are comfortable letting this skill automate a live Xiaohongshu account. Do not paste API keys or browser cookies into chat; configure secrets out of band and rotate any exposed key. Avoid the documented latest downloads unless you can pin and verify the MCP binary/package, and require a final explicit confirmation before any live post.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (6)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:1104
Finding

Unverified Mutable Remote Binary Is Downloaded and Executed

Content
View full analysis
mcp.log 2>&1 & ``` ### Technical Analysis The installation instructions retrieve a native executable from the mutable `latest` release of a personal GitHub repository. The archive is neither cryptographically signed nor checked against an expected digest before extraction and execution. Because the `latest` reference can resolve to different content after this Skill has been audited, the effective executable payload is outside the reviewed artifact and can change without a corresponding Skill update. The wildcard command `chmod +x xiaohongshu-*` also grants executable permission to every matching extracted file instead of only one validated binary. Although an MCP component is relevant to publishing, downloading and immediately running an unverified native executable is not the minimum safe privilege model for that functionality. ### Attack Path 1. An attacker compromises the upstream GitHub account, release workflow, repository credentials, or release asset. 2. The attacker replaces or republishes the asset referenced by the mutable `latest` URL. 3. A user or Agent follows the documented installation procedure. 4. The malicious archive is extracted without archive-entry validation or integrity verification. 5. Matching files are made executable. 6. The downloaded binary is launched with `nohup` under the installing user's account. 7. The process can access file ...[truncated 447 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Error
Location
SKILL.md:488
Finding

Unpinned Packages Are Automatically Downloaded and Executed

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:833
Finding

Live-Looking API Credential Is Embedded in Skill Documentation

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/generate.sh:106
Finding

Configurable API Endpoint Can Receive Bearer Credentials and Private Content Without Validation

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
check_env.sh:17
Finding

Environment Check Silently Starts System Services and Background Processes

Content
View full analysis
/dev/null; then echo "Xvfb service is running" elif pgrep -x Xvfb > /dev/null; then echo "Xvfb is running manually" else echo "Xvfb is not running; attempting to start the systemd service..." systemctl start xvfb 2>/dev/null sleep 1 if systemctl is-active --quiet xvfb 2>/dev/null; then echo "Xvfb service started" else echo "The systemd service does not exist; starting manually..." Xvfb :99 -screen 0 1920x1080x24 & sleep 1 echo "Xvfb started without a service manager" fi fi if systemctl is-active --quiet xhs-mcp 2>/dev/null; then echo "MCP service is running" elif pgrep -f xiaohongshu-mcp-linux > /dev/null; then echo "MCP service is running manually" else echo "MCP service is not running; attempting to start the systemd service..." systemctl start xhs-mcp 2>/dev/null sleep 2 if systemctl is-active --quiet xhs-mcp 2>/dev/null; then echo "MCP service started" else echo "The systemd service does not exist; starting manually..." cd ~/xiaohongshu-mcp && DISPLAY=:99 nohup ./xiaohongshu-mcp-linux-amd64 > mcp.log 2>&1 & sleep 3 fi fi ``` ### Technical Analysis The file is named and documented as an environment check, but it is not read-only. If Xvfb or the MCP service is absent, it attempts to start systemd units and then falls back to launching persistent background processes. Starting these components is related to publishing, but combining state changes with diagnostics violates the principle of least surprise and exceeds the minimum privilege needed to report environment status. This is particularly significant because the MCP binary is obtained through the unverified download process described elsewh ...[truncated 1090 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:656
Finding

Skill Instructs Users to Send API Secrets Through Chat

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (82)

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · README.html (reported line 388)May include surrounding context.

html
</style>
</head>
<body>
    <!-- 左侧菜单 -->
    <aside class="sidebar">
        <div class="logo">
            <h1>📕 xhs-publish Skill</h1>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · README.html (reported line 638)May include surrounding context.

html
</div>
            </div>

            <!-- 视频生成 -->
            <div id="video" class="page">
                <h2 class="page-title">视频生成</h2>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · README.html (reported line 638)May include surrounding context.

html
</div>
            </div>

            <!-- 视频生成 -->
            <div id="video" class="page">
                <h2 class="page-title">视频生成</h2>

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · README.html (reported line 748)May include surrounding context.

html
<h2 class="page-title">安装 MCP 服务</h2>

                <h3 class="page-subtitle">安装依赖</h3>
                <pre><code>sudo apt update && sudo apt install -y xvfb imagemagick zbar-tools xdotool fonts-noto-cjk</code></pre>

                <h3 class="page-subtitle">启动虚拟显示</h3>
                <pre><code>Xvfb :99 -screen 0 1920x1080x24 &</code></pre>

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

声明描述的是一个覆盖创意生成、文案撰写、多种内容形态生成以及最终发布的完整小红书发布流程工具。但提供的代码块只是 cover.sh，核心行为是生成封面图：校验参数、调用图像生成 API 或读取用户图片、裁剪缩放、生成标题文字底板、拼接为封面图并保存到本地。脚本确实支持多模型切换，且与“封面生成”这一子功能相符，但与声明中的主要目的相比明显不完整，也没有任何发布平台、正文创作、视频或知识卡片相关逻辑。因此描述对该代码块的能力构成了明显夸大，属于用途与实际行为不匹配。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

声明描述的是一个从创意到上线的小红书发布全流程工具，核心能力包含内容生成、多媒体素材生成和实际发布。提供的代码块却只是一个 shell 备用脚本，分为 title 和 content 两种模式，分别通过外部聊天补全 API 生成标题或正文。代码没有任何小红书平台接口调用、浏览器自动化、上传发布逻辑，也没有图像、卡片或视频生成相关处理。因此，实际行为仅覆盖声明中的一小部分，且缺失最关键的“发布”和多媒体生成能力，属于明显的描述与行为不一致。

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill instructs the agent to collect user API keys and configure environment variables, which goes beyond ordinary content publishing assistance and creates a credential-handling surface. Asking users to transmit secrets in chat or allowing the agent to install them into the environment risks leakage, reuse, and unauthorized access to third-party accounts.

Content

No source excerpt is available for this finding.

Ssd 3

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The skill explicitly tells users to send an API key directly in chat so the agent can configure it. Chat channels are not an appropriate secret-management interface, and secrets placed there may be retained in logs, transcripts, or downstream tooling.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The cookie-login fallback instructs collection and manual handling of browser session cookies such as a1, web_session, and id_token. These are highly sensitive authentication artifacts; if exposed to the agent, logs, or third parties, they can allow account takeover or session hijacking.

Content

No source excerpt is available for this finding.

Ssd 3

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

Directing users to extract and provide authentication cookies exposes live session credentials outside the browser security boundary. These cookies can often be replayed to impersonate the user, making this a serious account-compromise risk.

Content

No source excerpt is available for this finding.

Chaining Abuse

High
Category
Tool Misuse
Confidence
86% confidence
Finding

The chained command sudo apt update && sudo apt install bundles multiple privileged actions into one step, which reduces opportunities for review and increases the chance of unintended execution. In an agent context, command chaining can magnify the impact of a single mistaken approval or prompt injection.

Content

Scanner excerpt · SKILL.md (reported line 1092)May include surrounding context.

8.1 安装依赖

bash
sudo apt update && sudo apt install -y xvfb imagemagick zbar-tools xdotool fonts-noto-cjk

8.2 启动虚拟显示

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/generate.sh (reported line 83)May include surrounding context.

sh
)

  echo "🔄 正在生成小红书爆款标题..."
  RESULT=$(curl -s -X POST "$API_URL" \
    -H "Content-Type: application/json" \
    -H "Authorization: Bearer $API_KEY" \
    -d "$PAYLOAD")

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/generate.sh (reported line 126)May include surrounding context.

sh
)

  echo "🔄 正在生成小红书正文..."
  RESULT=$(curl -s -X POST "$API_URL" \
    -H "Content-Type: application/json" \
    -H "Authorization: Bearer $API_KEY" \
    -d "$PAYLOAD")

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.html (reported line 650)May include surrounding context.

html
<ol>
                    <li><strong>Seedance API Key</strong>：AI 视频生成服务，约 0.1 元/5秒<br><code>export DOUBAO_API_KEY="您的密钥"</code></li>
                    <li><strong>Edge TTS</strong>：微软语音合成，用于生成配音<br><code>npm install -g edge-tts</code> 或 <code>pip install edge-tts</code></li>
                    <li><strong>FFmpeg</strong>：视频处理工具，用于合并视频、添加配音和字幕<br><code>sudo apt install -y ffmpeg</code></li>
                </ol>

                <h3 class="page-subtitle">自动执行流程</h3>

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.html (reported line 748)May include surrounding context.

html
<ol>
                    <li><strong>Seedance API Key</strong>：AI 视频生成服务，约 0.1 元/5秒<br><code>export DOUBAO_API_KEY="您的密钥"</code></li>
                    <li><strong>Edge TTS</strong>：微软语音合成，用于生成配音<br><code>npm install -g edge-tts</code> 或 <code>pip install edge-tts</code></li>
                    <li><strong>FFmpeg</strong>：视频处理工具，用于合并视频、添加配音和字幕<br><code>sudo apt install -y ffmpeg</code></li>
                </ol>

                <h3 class="page-subtitle">自动执行流程</h3>

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README explicitly instructs the agent to publish immediately after content confirmation without an additional warning or explicit consent step for the account-impacting action. In a skill that automates posting to a real social-media account, this increases the risk of unintended publication, reputational damage, or accidental posting to the wrong account.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.html (reported line 725)May include surrounding context.

html
<h4>获取二维码</h4>
                <pre><code>MCP_URL="http://localhost:18060/mcp"
SESSION_ID=$(curl -s -D /tmp/headers -X POST "$MCP_URL" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","method":"initialize","params":{}},"id":1}' \
  > /dev/null && grep -i 'Mcp-Session-Id' /tmp/headers | awk '{print $2}')

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 1053)May include surrounding context.

md
<h4>获取二维码</h4>
                <pre><code>MCP_URL="http://localhost:18060/mcp"
SESSION_ID=$(curl -s -D /tmp/headers -X POST "$MCP_URL" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","method":"initialize","params":{}},"id":1}' \
  > /dev/null && grep -i 'Mcp-Session-Id' /tmp/headers | awk '{print $2}')

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.html (reported line 730)May include surrounding context.

html
-d '{"jsonrpc":"2.0","method":"initialize","params":{}},"id":1}' \
  > /dev/null && grep -i 'Mcp-Session-Id' /tmp/headers | awk '{print $2}')

curl -s --max-time 30 -X POST "$MCP_URL" \
  -H "Mcp-Session-Id: $SESSION_ID" \
  -d '{"jsonrpc":"2.0","method":"tools/call","params":{"name":"get_login_qrcode","arguments":{}},"id":2}'</code></pre>

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The cookie-login instructions tell users to extract and copy live session cookies such as a1 and web_session, but provide no warning that these are sensitive authentication credentials. Exposure of these values would allow account takeover or session hijacking until the session expires or is revoked.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The introduction presents the skill as a convenient publishing assistant but does not prominently warn that it can automatically post to a live Xiaohongshu account. Users may underestimate the consequences of invoking it, leading to unintended publication, reputational harm, or posting under the wrong account.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger example uses very broad natural-language phrasing like '帮我发个小红书', which can cause accidental invocation during ordinary conversation. Because this skill can generate and publish directly to a live social-media account, ambiguous activation materially increases the risk of unintended posting and account misuse.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The additional examples repeat generic trigger wording without scope limits, reinforcing that common conversational text is sufficient to activate the automation. In the context of a tool that can automatically publish content, this makes unintentional execution more dangerous than in a read-only or offline skill.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The video-note example shows activation from ordinary text split across multiple lines, suggesting the skill may trigger on loosely structured conversation rather than a clear command. For a skill that performs multi-step content generation and publication, this broad matching increases the chance of accidental execution from unrelated chat context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The credential setup section instructs users to export API keys and secrets but provides no warning about secure storage, shell history exposure, process visibility, or least-privilege handling. This can lead to credential leakage and unauthorized use of third-party APIs or publishing infrastructure.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.