T09 · Insecure Skill Coding Practices
Warning
- Location
publish.py:38- Finding
Predictable File Writes Permit Symlink-Based File Overwrite
- Content
View full analysis
- Remediation
View remediation
Security audit
小红书自动发布(macOS)
Security checks for vulnerabilities and agentic risk
Overview
This skill needs review because it can direct an agent toward public Xiaohongshu posting through a logged-in browser profile without clear final confirmation, while the bundled script only prepares a random image for manual upload.
Review this skill before installing. It is not backed by evidence of malware, but it is under-scoped for a public posting workflow: confirm the target Xiaohongshu account, inspect or replace any downloaded image, avoid running it with elevated privileges, and require an explicit final confirmation or draft-only behavior before anything is published.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
publish.py:31- Finding
Unbounded and Unvalidated Remote Image Download
- Content
View full analysis
- Remediation
View remediation
other
Note
- Location
SKILL.md:10- Finding
Documented Automatic Publishing Behavior Does Not Match the Implementation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The documented behavior overstates what the skill actually does, creating a trust gap between user expectations and real execution. Description-behavior mismatches are dangerous because users may approve actions they do not fully understand, or operators may fail to apply the right safeguards for downloading content and automating publication workflows.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill omits a prominent warning that it may automatically publish to a public platform and use network-downloaded images. This is especially risky in this skill's context because it combines external content acquisition with actions on a logged-in social-media account, creating legal, reputational, and account-safety risks if content is copyrighted, inappropriate, or posted unintentionally.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill describes use of network access and file-writing behavior but does not declare any tool scope or permission boundaries. In an agent ecosystem, this weakens least-privilege controls and can allow broader-than-expected access for downloading images or writing files, increasing the chance of unintended or abusive actions.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
An overly broad trigger phrase can cause accidental invocation during ordinary conversation, especially for a skill that performs browser automation and public posting. In this context, mistaken activation is more dangerous than usual because it may lead to unintended content preparation or publication to a live social-media account.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The alternate invocation example is underspecified and does not clearly constrain when the skill should trigger or what parameters are required. That ambiguity increases the risk of the agent interpreting loosely related user text as authorization to assemble and post public content.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The module description and all user-facing console messages are written only in Chinese, including the tool name and operational instructions. This creates a language/locale policy issue because the skill imposes a specific language on users without opt-in or justification that it is intended only for a Chinese-speaking or region-specific audience.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The manifest describes a skill that supports image search/download and automatic upload/publish in one step. In this file, the implementation stops after downloading an image and copying it into a local upload directory, then instructs the user to manually open Xiaohongshu, upload the image, fill fields, and click publish.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill description says it supports image search and download, and the function logs that it is searching by keyword. However, the code does not use the keyword to perform any search and instead downloads from a hardcoded picsum.photos endpoint, which returns a generic image unrelated to the requested topic.
- Content
Static analysis
No suspicious patterns detected.