Xiaohongshu Card Creator

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:01 AM UTC
• Version: 1.4.0

Overview

This card generator is not a backdoor, but it has under-disclosed optional LLM/API behavior and unsafe HTML generation that could expose content or run injected browser code.

Review generated cards before publishing, avoid running this on untrusted Markdown, and do not use --llm with private drafts or valuable API keys unless you trust the configured endpoint. The skill should document its LLM mode and sanitize generated HTML before broad use.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

other

Note

• Location: scripts/generate.sh:753

Finding

Undisclosed Promotional Content Is Injected into Generated Cards

Content

View full analysis

💬 你觉得这个内容有帮助吗？

A 非常有用 👍

B 还不错 😊

C 一般般 🤔

D 期待更多 🚀

📚 持续学习，不断进步

关注我，获取更多干货内容
一起成长！

💌 点赞关注

#干货分享 #学习成长 #知识分享 #自我提升

EOF ``` ### Technical Analysis The default generator inserts a fixed engagement solicitation into every card whose calculated type is seven. The inserted calls to follow and like are not derived from the source Markdown and are not disclosed by `SKILL.md`. This behavior compromises output integrity because the generated artifact can contain messaging that the user did not request or author. It does not alter the agent's session instructions, so it is classified as ...[truncated 729 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/generate.sh:143

Finding

Stored HTML and Script Injection through Unescaped Markdown Titles

Content

View full analysis

🤖

⚠️

${title}

精彩内容
点击查看详情

EOF ``` LLM generation path: ```python title = "小红书图文" for line in content.split('\n'): if line.startswith('# '): title = line[2:].strip() break ``` ```python html_parts.append(""" """ + title + """ ``` ```python html_parts.append(f"""

{title}

AI智能生成
LLM驱动的内容

""") ``` ### Technical Analysis The first level-one Markdown heading is treated as trusted HTML. It is inserted into both an HTML title element and an `h1` element without context-sensitive escaping. An attacker can use a heading such as: ```markdown #

``` When the generated file is ...[truncated 1346 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/generate_llm.py:212

Finding

Untrusted LLM Responses Are Inserted into Generated Pages as Active HTML

Content

View full analysis

") html_parts.append(llm_html) ``` ### Technical Analysis The LLM response is appended directly to the generated document as trusted HTML. Removing Markdown code-fence markers is not sanitization and does not remove active content such as: - `script` elements. - Inline event handlers such as `onerror` or `onclick`. - Iframes, SVG scripting, or active embedded objects. - Remote images, stylesheets, scripts, and tracking resources. - Malicious links and form elements. The source Markdown is included in the model prompt. An attacker can therefore place prompt-injection instructions in a section asking the model to ignore its formatting restrictions and emit a payload. The same result could arise from model error or a compromised custom model endpoint. ### Attack Path 1. An attacker supplies Markdown containing prompt-injection instructions in a level-two section. 2. The victim invokes `generate.sh --llm`. 3. The section is sent to the configured LLM. 4. The LLM emits malicious active HTML in response to the injected instructions. 5. The application only removes code-fence strings and appends the remaining response verbatim. 6. The victim opens the generated HTML file. 7. The browser parses and executes the model-generated active content. ### Impact Assessment Successful exploitation provides control over the generated browser page. Th ...[truncated 345 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/llm_helper.py:44

Finding

Unrestricted Custom LLM Endpoint Can Receive API Credentials and Private Article Content

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (41)

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill description materially overstates and misrepresents behavior, including claims of generic content conversion and smart mode while static analysis indicates fixed templates and a possible external LLM/Python path requiring undeclared network/API-key use. This is dangerous because users may provide sensitive document content under the assumption of local deterministic processing, when the implementation may instead send data to external services or behave in undocumented ways.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The skill description materially overstates and misrepresents behavior, including claims of generic content conversion and smart mode while static analysis indicates fixed templates and a possible external LLM/Python path requiring undeclared network/API-key use. This is dangerous because users may provide sensitive document content under the assumption of local deterministic processing, when the implementation may instead send data to external services or behave in undocumented ways.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

md

./scripts/generate.sh article.md -s

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

md

./scripts/generate.sh article.md -s

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

md

./scripts/generate.sh article.md -s

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

md

./scripts/generate.sh article.md -s

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.

md

./scripts/generate.sh article.md -s

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.

md

./scripts/generate.sh article.md -s

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.

md

./scripts/generate.sh article.md -s

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · output/xiaohongshu-cards.html (reported line 61)May include surrounding context.

html

<div class="controls"><button onclick="downloadAllCards()">📸 下载卡片图</button></div>
    <div id="cards-container">

        <!-- 第1张：封面 -->
        <div class="card card-cover" data-index="1">
            <h1>7个AI概念一次搞懂：大模型、Agent、API、Skill、MCP、Token、OpenClaw</h1>
            <p style="font-size: 16px; opacity: 0.9;">AI智能生成<br>LLM驱动的内容</p>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · output/xiaohongshu-cards.html (reported line 61)May include surrounding context.

html

<div class="controls"><button onclick="downloadAllCards()">📸 下载卡片图</button></div>
    <div id="cards-container">

        <!-- 第1张:封面 -->
        <div class="card card-cover" data-index="1">
            <h1>7个AI概念一次搞懂:大模型、Agent、API、Skill、MCP、Token、OpenClaw</h1>
            <p style="font-size: 16px; opacity: 0.9;">AI智能生成<br>LLM驱动的内容</p>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · output/xiaohongshu-cards.html (reported line 83)May include surrounding context.

html

<div style="font-size:12px;color:rgba(255,255,255,0.85);background:rgba(0,0,0,0.12);padding:6px 10px;border-radius:8px;">快速对照</div>
  </div>

  <!-- Divider -->
  <div style="height:1px;background:rgba(255,255,255,0.08);border-radius:1px;margin:6px 0 14px;"></div>

  <!-- Analogy list (icons + text) -->

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate.sh (reported line 21)May include surrounding context.

sh

# 加载 .env 文件中的环境变量
load_env_file() {
    local env_file="$SKILL_DIR/.env"
    if [ -f "$env_file" ]; then
        while IFS='=' read -r key value || [[ -n "$key" ]]; do
            # 跳过注释和空行

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate.sh (reported line 838)May include surrounding context.

sh

# 加载 .env 文件中的环境变量
load_env_file() {
    local env_file="$SKILL_DIR/.env"
    if [ -f "$env_file" ]; then
        while IFS='=' read -r key value || [[ -n "$key" ]]; do
            # 跳过注释和空行

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate.sh (reported line 19)May include surrounding context.

sh

import argparse
from pathlib import Path

# 加载 .env 文件
def load_env():
    script_dir = Path(__file__).parent.parent
    env_file = script_dir / '.env'

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate.sh (reported line 837)May include surrounding context.

sh

import argparse
from pathlib import Path

# 加载 .env 文件
def load_env():
    script_dir = Path(__file__).parent.parent
    env_file = script_dir / '.env'

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate_llm.py (reported line 11)May include surrounding context.

python

import argparse
from pathlib import Path

# 加载 .env 文件
def load_env():
    script_dir = Path(__file__).parent.parent
    env_file = script_dir / '.env'

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/llm_helper.py (reported line 12)May include surrounding context.

python

import argparse
from pathlib import Path

# 加载 .env 文件
def load_env():
    script_dir = Path(__file__).parent.parent
    env_file = script_dir / '.env'

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/llm_helper.py (reported line 14)May include surrounding context.

python

import argparse
from pathlib import Path

# 加载 .env 文件
def load_env():
    script_dir = Path(__file__).parent.parent
    env_file = script_dir / '.env'

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/llm_helper.py (reported line 155)May include surrounding context.

python

import argparse
from pathlib import Path

# 加载 .env 文件
def load_env():
    script_dir = Path(__file__).parent.parent
    env_file = script_dir / '.env'

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate_llm.py (reported line 14)May include surrounding context.

python

# 加载 .env 文件
def load_env():
    script_dir = Path(__file__).parent.parent
    env_file = script_dir / '.env'
    if env_file.exists():
        with open(env_file, 'r', encoding='utf-8') as f:
            for line in f:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/llm_helper.py (reported line 16)May include surrounding context.

python

# 加载 .env 文件
def load_env():
    script_dir = Path(__file__).parent.parent
    env_file = script_dir / '.env'
    if env_file.exists():
        with open(env_file, 'r', encoding='utf-8') as f:
            for line in f:

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill advertises file/environment-related behavior but does not declare any explicit tool scope or permissions. In an agent ecosystem, this creates a trust and containment problem: the runtime may grant broader capabilities than users expect, and undeclared file or environment access can expose local data or secrets during execution.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The root HTML element sets lang="zh-CN", and all visible UI text is presented only in Chinese. For this file type, natural-language policy checks apply, and the content does not indicate user opt-in to the language choice or a documented reason that the skill must be limited to this locale.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.