小红书赛道分析

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:13 AM UTC
• Version: 3.0.0

Overview

The skill is mostly purpose-aligned, but it needs Review because it collects platform content through authenticated sessions, keeps identifiable creator data despite de-identification claims, and points users to mutable external install steps.

Install only if you are comfortable using a supervised logged-in Xiaohongshu session and storing public creator/comment data locally. Before using it for client or business work, pin dependencies, avoid the mutable Agent-Reach install path unless separately reviewed, sanitize collected Markdown as untrusted source material, and remove or disclose the forced attribution in generated reports.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Note

• Location: scripts/finalize_report.py:388

Finding

Mandatory Promotional Content Injected into User Deliverables

Content

View full analysis

由擎漫网络 | Qomob.AI旗下小红书赛道深度分析引擎 v3.0.0提供支持 """ ``` The same attribution is also embedded directly in the Skill instructions and table template: ```markdown > 由擎漫网络 | Qomob.AI旗下小红书赛道深度分析引擎 v3.0.0提供支持 ``` ### Technical Analysis The Skill and both report-generation paths hard-code third-party promotional attribution into user-facing deliverables. The attribution is unrelated to the requested category analysis and cannot be disabled through any documented configuration or command-line option. Because `SKILL.md` defines this attribution as part of the Skill output and the scripts independently enforce it, the behavior persists whether the user creates a table through `scaffold_table.py` or generates a decision brief through `finalize_report.py`. This alters the expected output contract by inserting content selected by the Skill publisher rather than the user. No system privileges, code-execution privileges, or access to sensitive resources are obtained through this behavior. The issue affects the integrity and provenance of generated reports. ### Attack Path 1. A user requests a Xiaohongshu category analysis. 2. The Skill instructs the workflow to create a main table and decision brief. 3. The user or Agent invokes `scripts/scaffold_table.py` or `scripts/finalize_report.py`. 4. The script automatically appends the hard-coded Qomob.AI promotional attribution. 5. The user receives or distributes a report containing third-party promotional content that was not explicitly requested. ### Impact Assessment - Modifies every generated main table and finalized decision brief. - Introduces unwanted advertising into potenti ...[truncated 233 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/collector/collect.py:267

Finding

Indirect Prompt Injection Through Unsanitized Public Content

Content

View full analysis

= limit: break logd(f"[detail] 评论轮次 {i+1}/{cfg.get('comment_scrolls', 5)}：可见评论条目 {len(items)}，已保存 {len(comments)} 条") if len(comments) >= limit: note["completion_state"] = "partial_comments_limit" logd("[detail] 状态：达到评论上限 → partial_comments_limit") break if len(comments) == last_count: stagnant += 1 else: stagnant = 0 last_count = len(comments) if stagnant >= 2: note["completion_state"] = "complete_visible_note" logd("[detail] 状态：连续滚动无新增评论 → complete_visible_note") break page.mouse.wheel(0, 800) time.sleep(float(cfg.get("delay_sec", 3))) else: if note["completion_state"] != "partial_comments_limit": note["completion_state"] = "complete_visible_note" logd("[detail] 状态：滚动耗尽仍未达上限 → complete_visible_note") note["comment_sample"] = comments[:limit] ``` The untrusted content is then written into Markdown intended for downstream Skill analysis: ```python commented = [n for n in all_notes if n.get("comment_sample") or n.get("body")] if commented: f.write("\n## 评论明细（ ...[truncated 2403 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/collector/collect.py:196

Finding

Collector Retains Personal Identifiers Despite De-identification Requirements

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/collector/requirements.txt:1

Finding

Unpinned Dependencies and Mutable External Installation Instructions

Content

View full analysis

=1.44.0 ``` The documentation instructs the Agent to install an external component through a mutable document on a repository's default branch: ```markdown [Agent-Reach](https://github.com/Panniantong/Agent-Reach) 是 Agent 的互联网能力层（非本 Skill 组件）：一句话安装后，Agent 可调用其 xiaohongshu 渠道读取公开笔记 / 评论 / 达人主页，返回内容注入本 Skill 结构化。 - **安装**：让 Agent 执行 `帮我安装 Agent Reach：https://raw.githubusercontent.com/Panniantong/agent-reach/main/docs/install.md` - **渠道**：OpenCLI（复用本机已有 Chrome 会话）▸ xiaohongshu-mcp ▸ xhs-cli；`agent-reach doctor` 可体检渠道状态。 - **合规**：仅读取公开可见内容、控频；登录态渠道存在封号风险（官方建议专用小号）。OpenCLI 只复用用户已有且明确控制的会话，不注入 Cookie。 - **边界**：本 Skill 只**引用**其渠道（引知识），不复制 / 内化其安装与路由代码；代码层对接可在 `scripts/integrations/` 的 `DataSource` 抽象下另建 `agentreach` 适配器（当前未提供）。 ``` The integration instructions also install an unpinned package: ```bash cd scripts/integrations pip install requests cp config.example.json config.json # 编辑 config.json：source 选 pgy/juguang/thirdparty，并在 credentials 填 token python3 run_pipeline.py config.json ``` ### Technical Analysis Version ranges and unconstrained package installation make build behavior dependent on whatever versions package repositories serve at installation time. The absence of lock files and integrity hashes prevents users from reproducing or verifying the audited dependency set. The Agent-Reach instruction is more sensitive because it delegates installation behavior to a mutable raw file under the `main` branch. The effective installation procedure can change after this Skill has been re ...[truncated 1615 chars]

Remediation

View remediation

` and `requests==`. 2. Generate a lock file containing transitive dependencies. 3. Require package hashes using a hash-locked requirements file. 4. Reference external installation documentation by an immutable commit hash rather than `main`. 5. Review and vendor critical installation instructions inside the repository. 6. Require explicit human approval before an Agent follows any external installation document. 7. Install dependencies in an isolated virtual environment or container with minimal filesystem and credential access. 8. Add dependency scanning and scheduled update review instead of automatically accepting future versions. 9. Document the exact reviewed versions and checksums in `VERIFICATION.md`. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (30)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README includes very broad natural-language trigger examples such as '做一份小红书赛道分析' without clear activation boundaries, permitted inputs, or refusal conditions. In an agent skill context, this can cause over-broad invocation and unintended handling of adjacent requests involving scraping, profiling, or competitive intelligence beyond the author’s stated safe workflow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README explicitly describes collecting public notes, profiles, and comments, but it does not present an explicit privacy/data-handling warning, retention policy, or guidance against collecting unnecessary personal data. Even when data is public, this workflow can enable large-scale aggregation, profiling, and downstream misuse of user-generated content if operators are not warned to minimize collection and handle personal information carefully.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest description and role instructions are written as Chinese-only operational guidance, including trigger phrases and task framing, with no indication that users may choose another language. Under the policy for natural-language violations, imposing a specific language without opt-in is reportable unless the locale restriction is explicitly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The verification examples define activation and non-activation prompts entirely in Chinese, which effectively constrains use to a specific language. The file does not offer multilingual alternatives, user opt-in, or a documented justification that this skill is intentionally region- or locale-specific.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The positive trigger at these lines uses broad natural-language phrasing for analyst-style tasks around a creator's content and suitability, which can overlap with adjacent skills or general assistant behavior. In a routing system, this can cause unintended invocation, misclassification of user intent, and execution of the wrong analysis workflow, especially because the file itself emphasizes known boundary problems between赛道级 and账号级 analysis.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document title and all instructional content are written entirely in Chinese, with no indication that users may choose another language or locale. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documentation claims the tool only collects public search-result and public note-page content, but the implementation requires an authenticated Xiaohongshu session via QR login and explicitly checks for a web_session cookie. That mismatch is security-relevant because it can mislead users and downstream reviewers about the access level, account exposure, and compliance implications of running the script; authenticated browsing can also expose more data than an anonymous session and increases account-risk surface.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This is a natural-language policy issue because the file presents usage, errors, prompts, and generated report text entirely in Chinese, which effectively imposes a specific language on users. The file does not provide any opt-in, alternative locale, or justification that the skill is intended only for a Chinese-language or region-specific workflow.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The file embeds Chinese keywords and sort labels as the only apparent language/locale option, which can amount to a language or locale policy restriction if users are not given an explicit choice. There is no indication in this file that the locale constraint is optional or justified as region-specific.

Content

No source excerpt is available for this finding.

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution
• Confidence: 75% confidence

Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/integrations/juguang.py (reported line 38)May include surrounding context.

python

likes=int(raw.get("likes", 0) or 0),
            collects=int(raw.get("collects", 0) or 0),
            comments=int(raw.get("comments", 0) or 0),
            captured_at=__import__("datetime").date.today().isoformat(),
        )

    def search_notes(self, keyword, sort, limit=20):

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution
• Confidence: 75% confidence

Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/integrations/pgy.py (reported line 41)May include surrounding context.

python

likes=int(raw.get("likes", 0) or 0),
            collects=int(raw.get("collects", 0) or 0),
            comments=int(raw.get("comments", 0) or 0),
            captured_at=__import__("datetime").date.today().isoformat(),
        )

    def search_notes(self, keyword, sort, limit=20):

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution
• Confidence: 75% confidence

Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/integrations/thirdparty.py (reported line 50)May include surrounding context.

python

likes=int(raw.get("likes", 0) or 0),
            collects=int(raw.get("collects", 0) or 0),
            comments=int(raw.get("comments", 0) or 0),
            captured_at=__import__("datetime").date.today().isoformat(),
        )

    def search_notes(self, keyword, sort, limit=20):

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

User-facing natural-language content in the module docstring, usage text, and runtime messages is entirely in Chinese. Under the policy, forcing a specific language without user opt-in or documented justification is a locale/language policy issue.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

No manifest is available, so the skill's stated purpose is unknown. The code nevertheless instantiates source-specific adapters, authenticates to them, and queries external data sources, which are substantive capabilities not justified by any declared purpose in the manifest context provided.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The description and step names are entirely in Chinese, which establishes a language-specific interface/contract in natural language. There is no indication that users may choose another language or that the locale restriction is required for a region-specific compliance purpose.

Content

No source excerpt is available for this finding.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · README.md (reported line 112)May include surrounding context.

md

copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

This trigger phrase relies on generic helper wording ('帮我做一份...报告') without enough constraints about scope, data source, or analysis boundaries. Such phrasing is likely to overmatch many ordinary requests for reports, increasing false activations and reducing reliability of skill selection, though the consequence is primarily functional rather than directly security-critical.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown playbook mandates a single language/locale for the skill instructions and user confirmation text, but does not indicate that users may choose another language. Under the policy provided, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown file presents all user-facing instructions in Chinese and does not indicate that users may choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the policy rule for language or locale constraints, forcing a single language without opt-in can be a natural-language policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown file contains user-facing instructions and required output text exclusively in Chinese, including the mandatory attribution block. Under the language/locale policy rule, forcing a specific language without offering an alternative or explicit opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The example configuration uses only Chinese keywords and Chinese sort labels, which implies the skill is tailored to a specific language/locale. Because the file provides no indication that this is optional, configurable for other locales, or intentionally region-specific, it may violate the policy against forcing a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The dependency is specified with a lower-bound range (playwright>=1.44.0) rather than being pinned to an exact version, which makes builds non-reproducible and allows future installs to pull in unexpected upstream changes. If a later Playwright release introduces a malicious package compromise, breaking change, or vulnerable transitive dependency, this skill could begin using it without review.

Content

Scanner excerpt · scripts/collector/requirements.txt (reported line 1)May include surrounding context.

text

playwright>=1.44.0

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This manifest-style JSON file defines activation/search keywords, but it provides only a short list of phrases without any negative examples, trigger boundaries, or explanation of when they should or should not be used. That makes the trigger scope somewhat ambiguous and increases the chance of unintended matches in adjacent contexts.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This code file contains user-facing natural language stating the adapter is for demonstration in Chinese, and the adapter name also embeds Chinese text. Under the language/locale policy rule, forcing a specific language without offering a choice can be a policy concern, especially where the skill may be used in broader contexts.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The module docstring and all user-facing guidance are written only in Chinese, and the file provides no indication that users can choose another language or locale. The policy explicitly flags language or locale constraints when they are imposed without opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.