Sayba Redbook — 小红书运营分析

• Outcome: Review
• Latest audit: May 29, 2026 · 9:40 PM UTC
• Version: 0.5.0

Overview

This is a disclosed Xiaohongshu automation tool, but it needs Review because it automatically accesses browser session cookies, persists itself into Claude, and can perform real account actions.

Install only if you are comfortable giving this package access to your Xiaohongshu browser session and letting it make real actions on your account. Prefer a dedicated browser profile for Xiaohongshu, avoid pasting cookie strings into chats or shell history, review any comment/post/batch-reply command before running it, and be aware the npm install modifies your Claude skills directory automatically.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (24)

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The CLI metadata and description emphasize search/read/analyze, but this file also implements state-changing actions such as posting notes, commenting, replying, collecting, and uncollecting content. This is dangerous because users or orchestrating agents may grant trust or permissions based on an incomplete description, leading to unexpected account actions and higher abuse risk.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The CLI can extract authentication cookies directly from local browser profiles and use them to authenticate to Xiaohongshu. Accessing stored browser session tokens is highly sensitive because it enables account access without re-authentication, and in an agent context this resembles credential harvesting behavior even if intended for convenience.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The skill metadata says it is for searching, reading, analyzing, and automating Xiaohongshu content, but this code also supports media upload and note publication. That is a scope mismatch that can mislead users or upstream agents into granting credentials and file access for a read-oriented tool while it actually performs high-impact write actions to a live social platform.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: This client includes state-changing social actions such as collect/uncollect and comment/reply operations that are not clearly reflected in the stated search/read/analyze description. Hidden mutation capabilities increase the risk of unauthorized engagement, spam, or account-impacting actions when an operator believes the skill is read-only or low-risk.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: This file contains curated GPU, screen resolution, plugin, and font data explicitly intended to generate realistic browser fingerprints, which is an anti-detection/evasion capability rather than a normal requirement for a CLI that searches or analyzes content. In the context of Xiaohongshu automation, spoofed fingerprint data can be used to impersonate legitimate browsers, evade bot detection, and facilitate bulk scraping or account abuse while reducing attribution and enforcement effectiveness.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The code converts untrusted markdown to HTML with `marked.parse(md)` and injects it into a headless Chrome instance via `page.setContent(...)` without sanitizing markup or restricting network access. As a result, attacker-controlled markdown can cause remote resource fetches such as external images during rendering, contradicting the 'purely offline' claim and potentially leaking IP, environment/network metadata, or enabling SSRF-like requests from the host running the renderer.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: This code goes beyond ordinary CLI content access and explicitly generates anti-bot evasion artifacts: synthetic browser fingerprints, request-signing headers, and trace identifiers designed to imitate first-party web traffic. In the context of a Xiaohongshu automation skill, that materially increases the capability to bypass platform access controls and makes abusive scraping or unauthorized automation more feasible.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The README explicitly instructs users to manually pass live Xiaohongshu session cookies via `--cookie-string`, but does not clearly warn that these are bearer credentials that can grant account access. In an AI-agent context, this is especially risky because users may paste cookies into agent chats, logs, shell history, or telemetry, exposing their account session to third parties.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The quick-start text encourages delegating installation, connection verification, and cookie troubleshooting to an AI assistant without warning that the assistant may receive or request browser session data. That creates a real risk of credential disclosure because users may authorize the agent to inspect browser state, paste cookie strings, or expose secrets through transcripts and tool logs.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The skill explains how to use browser-derived cookies and session data but does not present a clear, consolidated warning about privacy and account-security implications. This is dangerous because users may not realize the tool can access authenticated browser state and thereby expose or misuse their Xiaohongshu session.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The quick-reference section includes account-mutating operations such as commenting, replying, collecting, and posting without a consolidated warning that these commands perform real actions on the user's account. This creates a meaningful risk of accidental misuse, spam, or reputation damage because users may treat the skill as read-only analytics tooling.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The document recommends sending user-provided content to Gemini and saving generated PNGs locally, but it does not mention privacy, consent, cost, retention, or filesystem side effects. In a skill context, this can lead to unanticipated exfiltration of sensitive content to a third-party API and unexpected local file writes when an agent follows the documented workflow.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The CLI accepts a raw cookie string containing active session credentials but provides no strong security warning about the sensitivity of these values. Users may paste reusable session tokens into shell history, logs, process listings, or automation systems, exposing their account to takeover.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The tool advertises browser-cookie extraction as a normal option without clearly warning that it accesses stored session credentials from local browser profiles. In an agent or automation setting, this can normalize high-risk credential access and cause users to authorize behavior they would not otherwise permit.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The exported API path automatically extracts authentication cookies from local browser stores and, on failure, falls back to launching Chrome via CDP to read them directly. Even if intended for user convenience, this is credential-access behavior involving highly sensitive session tokens, and there is no explicit consent gate, warning, or scope restriction in this path, so misuse could enable account takeover for the Xiaohongshu session.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The fingerprint object includes a raw cookie string in x57, meaning sensitive session-related data is embedded into generated telemetry/signing material. Even if intended for request reproduction, this increases the chance of accidental leakage through logs, error reporting, downstream transmission, or reuse in ways users may not expect.

Ssd 4

Medium

• Confidence: 94% confidence
• Finding: This section provides an operational workflow for automating social-platform engagement, including batching replies and human-in-the-loop execution. In context, it is dangerous because it facilitates scaled account actions on a third-party platform and can be used for spam or manipulation even if framed as productivity.

Ssd 2

Medium

• Confidence: 97% confidence
• Finding: The document explicitly teaches anti-detection measures such as timing jitter, activity caps, template variation, and avoiding patterns that trigger bot detection. Guidance designed to evade platform safeguards is dangerous because it helps users operate automation while reducing the chance of detection, crossing from normal automation into stealthy abuse enablement.

Credential Access

High

• Category: Privilege Escalation

Content

- Uses `@steipete/sweet-cookie` to read browser cookies
- Auto-discovers Chrome profiles via `~/Library/Application Support/Google/Chrome/Local State`
- Keychain timeout patched to 30s in node_modules (upstream bug: hardcoded 3s)
- `--chrome-profile` flag available as escape hatch, but auto-discovery handles most cases

• Confidence: 89% confidence
• Finding: The skill explicitly documents reading browser cookies from Chrome profiles and interacting with the macOS Keychain to obtain them. Even if intended to authenticate the user's own Xiaohongshu session, browser-cookie extraction is a sensitive credential-access mechanism that can expose reusable session tokens and broaden compromise if the CLI, dependencies, or logs are abused.

Credential Access

High

• Category: Privilege Escalation

Content

After installing, run `redbook whoami` to verify the connection. The CLI auto-detects all Chrome profiles to find your XHS session.

- **macOS** — If Keychain prompt appears, click "Always Allow"
- **Windows** — Chrome 127+ uses App-Bound Encryption. The CLI auto-launches Chrome headless to read cookies (close Chrome first). If auto-extraction fails, use `--cookie-string` as fallback

## What You Can Do

• Confidence: 89% confidence
• Finding: This documentation normalizes automatic discovery of Chrome profiles, use of macOS Keychain access, and headless Chrome cookie extraction to obtain authentication material from a logged-in browser session. Even if intended for convenience, this is credential-access behavior and is dangerous because it expands the path by which an agent or tool can harvest reusable session tokens from the user's machine.

Credential Access

High

• Category: Privilege Escalation

Content

| `No 'a1' cookie found` | Log into xiaohongshu.com in Chrome, then retry |
| Windows `-101` error | Chrome 127+ App-Bound Encryption. **Close Chrome first**, then re-run (CLI auto-launches Chrome headless to read cookies). If it still fails, use `--cookie-string` |
| Windows `--cookie-string` | Press F12 in Chrome → Application → Cookies → xiaohongshu.com. Copy `a1` and `web_session` values: `redbook whoami --cookie-string "a1=VALUE; web_session=VALUE"` |
| macOS Keychain prompt | Enter your password and click "Always Allow" — the CLI needs to decrypt Chrome's cookies |
| Multiple Chrome profiles | The CLI auto-scans all profiles (macOS / Windows / Linux). To pick one: `--chrome-profile "Profile 1"` |
| Using Brave/Arc/other | Try `--cookie-source safari`, or log into xiaohongshu.com in Chrome |

• Confidence: 91% confidence
• Finding: The troubleshooting section tells users to copy cookie values from Chrome DevTools and grant persistent Keychain access so the CLI can decrypt browser cookies. Those steps directly facilitate extraction of live session credentials, and in the context of an agent-integrated skill they are more dangerous because users may hand those credentials to an automated system or expose them in recorded command history.

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

• Category: YARA Match

Content

- `src/cli.ts` — CLI entry point, 15 commands, `getClient()` is the single cookie→client funnel
- `src/lib/client.ts` — XHS API client (`postComment`, `replyComment`, etc.)
- `src/lib/cookies.ts` — Cookie extraction with Chrome profile auto-discovery
- `src/lib/signing.ts` — Request signing
- `src/lib/analyze.ts` — Viral note analysis and question detection
- `src/lib/reply-strategy.ts` — Batch reply filtering, templating, rate-limited execution

• Confidence: 84% confidence
• Finding: The documented architecture centers on a 'single cookie→client funnel' and a dedicated cookie-extraction module with Chrome profile auto-discovery, which strongly resembles browser credential harvesting behavior. In the context of a CLI that automates account actions, this increases risk because stolen or over-broadly accessed session cookies can enable account takeover or unauthorized posting without the user re-authenticating.

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

• Category: YARA Match

Content

|------|----------|
| `No 'a1' cookie found` | 在 Chrome 中登录 xiaohongshu.com，然后重试 |
| Windows 上 `-101` 错误 | Chrome 127+ 的 App-Bound Encryption 导致。先**关闭 Chrome**，再运行命令（CLI 会自动启动 Chrome headless 读取 Cookie）。如仍失败，用 `--cookie-string` 手动传入 |
| Windows `--cookie-string` 用法 | Chrome 按 F12 → Application → Cookies → xiaohongshu.com，复制 `a1` 和 `web_session` 的值：`redbook whoami --cookie-string "a1=值; web_session=值"` |
| macOS 钥匙串弹窗 | 输入密码后点击"始终允许"，CLI 需要读取 Chrome 的加密 Cookie |
| 多个 Chrome 配置文件 | CLI 自动扫描所有配置文件（macOS / Windows / Linux）。如需指定：`--chrome-profile "Profile 1"` |
| 使用 Brave/Arc 等浏览器 | 尝试 `--cookie-source safari`，或在 Chrome 中登录 |

• Confidence: 90% confidence
• Finding: The README describes loading cookies from Chrome, scanning browser profiles, decrypting stored cookies, and manually supplying cookie strings, which matches information-stealer-style behavior even if the stated purpose is service authentication. In this skill context, the combination of browser credential extraction plus AI-agent automation materially increases risk because it can enable silent harvesting or misuse of reusable session tokens.

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

• Category: YARA Match

Content

*
 * When sweet-cookie can't fully decrypt Chrome cookies on Windows
 * (Chrome 127+ uses App-Bound Encryption), this module connects to
 * Chrome via its DevTools Protocol to read cookies directly — Chrome
 * itself handles decryption, so all cookies are readable.
 *
 * Flow:

• Confidence: 96% confidence
• Finding: This code is explicitly designed to bypass Chrome’s normal cookie protection by launching or attaching to a Chrome DevTools session and extracting decrypted cookies, including via temporary profile copying when the profile is locked. That behavior matches credential/session theft patterns because browser cookies can be used to hijack authenticated sessions without needing passwords, and the surrounding skill context ('search, read, analyze, and automate Xiaohongshu content via CLI') makes this especially dangerous because it operationalizes account access against a third-party service.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: src/lib/cdp-cookies.ts:173