T09 · Insecure Skill Coding Practices
Error
- Location
scripts/postinstall.js:29- Finding
Post-install Script Destructively Replaces Existing Agent Skill State
- Content
View full analysis
- Remediation
View remediation
Security audit
Sayba Redbook — 小红书运营分析
Security checks for vulnerabilities and agentic risk
Overview
The skill is openly a Xiaohongshu automation tool, but it needs Review because it handles live browser login cookies, alters agent skill state during install, and includes anti-detection automation guidance.
Install only if you are comfortable letting this tool use your active Xiaohongshu browser session and perform account actions such as posting, commenting, collecting, and batch replies. Avoid pasting cookies into chats or shell history, review any batch-reply or posting action manually, and be aware that installation can overwrite an existing redbook Claude skill path.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
src/lib/render.ts:531- Finding
Untrusted Markdown Is Rendered as Active HTML in an Unsandboxed Browser
- Content
View full analysis
{ try { const { marked } = await import("marked"); return await marked.parse(md); } catch { console.error(kleur.red("Card rendering requires marked.")); console.error(kleur.dim("Install it with:")); console.error(kleur.dim(" npm install -g marked")); process.exit(1); } } ``` The renderer reads caller-selected content and launches Chrome with its sandbox disabled: ```ts const content = readFileSync(absPath, "utf-8"); const { frontmatter, body } = parseCardMarkdown(content); ``` ```ts const browser = await launch.call(puppeteer.default ?? puppeteer, { executablePath: chromePath, headless: true, args: ["--no-sandbox", "--disable-setuid-sandbox", "--disable-gpu"], }); ``` The generated HTML is then loaded as active page content without JavaScript restrictions, request interception, sanitization, or a Content Security Policy: ```ts const html = await markdownToHtml(pages[i]); const cardHtml = buildCardHtml( html, i + 1, pages.length, style, opts.width, opts.height ); await page.setContent(cardHtml, { waitUntil: "domcontentloaded" }); ``` ### Technical Analysis `marked.parse()` is a Markdown parser, not an HTML sanitizer. Raw HTML embedded in Markdown can be retained in the generated output. The renderer inserts that output directly into a browser document and calls `page.setContent()`. No control in the audited code: - Removes `- Remediation
View remediation
{ const url = new URL(request.url()); if (url.protocol === "data:" || url.protocol === "about:") { request.continue(); } else { request.abort(); } }); ``` 4. If local images are required, explicitly resolve and validate them against an approved base directory. Reject path traversal and all unapproved URL schemes. 5. Add a restrictive Content Security Policy, for example: ```html ``` 6. Remove `--no-sandbox` and `--disable-setuid-sandbox`. Fail with a clear error if the environment cannot run Chrome safely with sandboxing enabled. 7. Configure the Markdown parser to reject raw HTML where possible. 8. Add regression tests covering: - Raw `
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (70)
YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]
High
- Category
- YARA Match
- Confidence
- 90% confidence
- Finding
The documentation explicitly describes extracting browser cookies from Chrome profiles and funneling them into an API client for authentication. Even though this may be intended as account automation rather than credential theft, browser-cookie harvesting is highly sensitive because session cookies can grant direct account access without passwords and can expose unrelated browser data if mishandled.
- Content
md Manual trigger via `workflow_dispatch` is also available. ## Build & Test - `npm run build` — TypeScript compile + chmod - No test suite yet — verify manually with `redbook whoami` ## Project Structure - `src/cli.ts` — CLI entry point, 15 commands, `getClient()` is the single cookie→client funnel - `src/lib/client.ts` — XHS API client (`postComment`, `replyComment`, etc.) - `src/lib/cookies.ts` — Cookie extraction with Chrome profile auto-discovery - `src/lib/signing.ts` — Request signing - `src/lib/analyze.ts` — Viral note analysis and question detection - `src/lib/reply-strategy.ts` — Batch reply filtering, templating, rate-limited execution - `src/lib/template.ts` — Viral content template extraction - `src/lib/render.ts` — Card rendering (markdown → PNG via puppeteer-core, optional dep) - `SKILL.md` — Skill documentation (serves both Claude Code and OpenClaw/ClawHub) - `.github/workflows/npm-publish.yml` — CI: build, npm publish, ClawHub publish ## R
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The quick-start explicitly tells users to give an AI agent responsibility for installation, connection verification, and cookie-related troubleshooting. That encourages delegated handling of authentication material by an autonomous system, which can lead to session token exposure through prompts, logs, tool outputs, or copied browser data. In an agent skill, this is especially dangerous because the README frames credential access as a normal part of agent operation.
- Content
YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]
High
- Category
- YARA Match
- Confidence
- 75% confidence
- Finding
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
- Content
md | | `render <文件>` | Markdown 渲染为小红书图文卡片 PNG（需可选依赖） | ### 通用选项 | 选项 | 说明 | 默认值 | |------|------|--------| | `--cookie-source <浏览器>` | Cookie 来源浏览器（chrome, safari, firefox） | `chrome` | | `--chrome-profile <名称>` | Chrome 配置文件目录名（如 "Profile 1"），默认自动检测 | 自动 | | `--cookie-string <cookies>` | 手动传入 Cookie 字符串：`"a1=值; web_session=值"`（从 Chrome DevTools 复制） | 无 | | `--json` | JSON 格式输出 | `false` | ### 搜索选项 | 选项 | 说明 | 默认值 | |------|------|--------| | `--sort <类型>` | `general`（综合）、`popular`（热门）、`latest`（最新） | `general` | | `--type <类型>` | `all`（全部）、`video`（视频）、`image`（图文） | `all` | | `--page <页码>` | 页码 | `1` | ### 分析选项（analyze-viral / viral-template） | 选项 | 说明 | 默认值 | |------|------|--------| | `--comment-pages <n
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
These instructions tell users to manually copy live session cookie values from DevTools and supply them to the CLI in plain text. Plain-text bearer tokens are highly sensitive and may leak via terminal history, process inspection, clipboard managers, remote shells, and AI assistant transcripts, enabling unauthorized account access. Because the skill is designed for automation, the likelihood of accidental disclosure is higher than in a purely local manual workflow.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The English quick-start repeats the unsafe pattern of delegating browser-cookie authentication troubleshooting to an AI agent. This materially increases the chance that users will expose session credentials to an agent or allow the agent to access the local browser profile on their behalf. The skill context makes this more dangerous because the setup path explicitly targets coding agents as the primary operator.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The troubleshooting section instructs users to copy active session cookie values from Chrome DevTools and pass them directly to the command. Those cookies can be replayed as bearer credentials, so any leakage through shell history, telemetry, screenshots, or agent logs can immediately compromise the user's Xiaohongshu account. The danger is amplified in this skill because agent-assisted setup is promoted elsewhere in the README.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The documented anti-bot context, device fingerprint discussion, and references to protected API access suggest the tool may facilitate access patterns beyond a neutral analytics CLI. If the implementation generates signing headers or synthetic fingerprint telemetry, that would materially increase operational and policy risk by helping automate around platform protections.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The documented anti-bot context, device fingerprint discussion, and references to protected API access suggest the tool may facilitate access patterns beyond a neutral analytics CLI. If the implementation generates signing headers or synthetic fingerprint telemetry, that would materially increase operational and policy risk by helping automate around platform protections.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The documented anti-bot context, device fingerprint discussion, and references to protected API access suggest the tool may facilitate access patterns beyond a neutral analytics CLI. If the implementation generates signing headers or synthetic fingerprint telemetry, that would materially increase operational and policy risk by helping automate around platform protections.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The documented anti-bot context, device fingerprint discussion, and references to protected API access suggest the tool may facilitate access patterns beyond a neutral analytics CLI. If the implementation generates signing headers or synthetic fingerprint telemetry, that would materially increase operational and policy risk by helping automate around platform protections.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The documented anti-bot context, device fingerprint discussion, and references to protected API access suggest the tool may facilitate access patterns beyond a neutral analytics CLI. If the implementation generates signing headers or synthetic fingerprint telemetry, that would materially increase operational and policy risk by helping automate around platform protections.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The documented anti-bot context, device fingerprint discussion, and references to protected API access suggest the tool may facilitate access patterns beyond a neutral analytics CLI. If the implementation generates signing headers or synthetic fingerprint telemetry, that would materially increase operational and policy risk by helping automate around platform protections.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The documented anti-bot context, device fingerprint discussion, and references to protected API access suggest the tool may facilitate access patterns beyond a neutral analytics CLI. If the implementation generates signing headers or synthetic fingerprint telemetry, that would materially increase operational and policy risk by helping automate around platform protections.
- Content
Natural-Language Policy Violations
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This section gives concrete anti-detection instructions for automating platform interactions, such as using timing jitter and avoiding patterns that trigger bot detection. That is dangerous because it directly enables users or agents to evade platform safeguards while performing automated actions on an authenticated account.
- Content
Natural-Language Policy Violations
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The best-practices section instructs users how to space and vary automated actions to reduce detection, which is functionally an evasion playbook. In context, this supports stealthy automated engagement and increases the likelihood of account abuse, policy violations, or large-scale spam automation.
- Content
YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]
High
- Category
- YARA Match
- Confidence
- 89% confidence
- Finding
The sample code loads cookies from Chrome and uses them to instantiate an authenticated client. While that can be legitimate for session reuse, it matches information-stealer patterns because it programmatically harvests browser session material, which is highly sensitive and transferable if mishandled.
- Content
intersections) 4. Audience Persona (demographics, intent, preferences) 5. Competitive Landscape (creator profiles, strategy patterns) 6. Content Opportunities (tiered recommendations with data backing) 7. Content Ideas (specific hooks, angles, targets)
Programmatic API
typescript import { XhsClient } from "@lucasygu/redbook"; import { loadCookies } from "@lucasygu/redbook/cookies"; const cookies = await loadCookies("chrome"); const client = new XhsClient(cookies); const results = await client.searchNotes("AI编程", 1, 20, "popular"); const topics = await client.searchTopics("Claude Code");Requirements
- Node.js >= 22
- Logged into xiaohongshu.com in Chrome (or Safari/Firefox with
--cookie-source) - macOS (cookie extraction uses native keychain access)
- For card rendering only:
puppeteer-coreandmarked(npm install -g puppeteer-core marked). Uses your existing Chrome — no additional browser download.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 93% confidence
- Finding
The requirement that cookie extraction uses native keychain access indicates the skill accesses sensitive local credential material to authenticate against Xiaohongshu. In an agent context, accessing browser cookies and keychain-protected secrets materially raises the risk of credential theft, account compromise, and unintended cross-account access.
- Content
md - Node.js >= 22 - Logged into xiaohongshu.com in Chrome (or Safari/Firefox with `--cookie-source`) - macOS (cookie extraction uses native keychain access) - **For card rendering only:** `puppeteer-core` and `marked` (`npm install -g puppeteer-core marked`). Uses your existing Chrome — no additional browser download.
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
md 2. **Add persona-based reply** — extend `batch-reply` with `--persona <file>` option 3. **Add Gemini cover generation** — new `generate-cover` command with optional `@google/genai` dep 4. **Add Module L** to SKILL.md — AI Cover Generation analysis module 5. **Update SKILL.md metadata** — add `requires.env` for `GEMINI_API_KEY` (optional) 6. **Add `redbook monitor`** — simple comment monitoring loop with configurable interval ---
Known Vulnerable Dependency: basic-ftp==5.2.0 — 4 advisory(ies): GHSA-6v7q-wjvx-w8wg (basic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Exe); CVE-2026-39983 (basic-ftp has FTP Command Injection via CRLF); CVE-2026-41324 (basic-ftp vulnerable to denial of service via unbounded memory consumption in Cl) +1 more
High
- Category
- Supply Chain
- Confidence
- 80% confidence
- Finding
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
- Content
Known Vulnerable Dependency: extract-zip==2.0.1 — 2 advisory(ies): CVE-2026-19693 (extract-zip allows arbitrary file writes through symlink archive entries); CVE-2026-56876 (extract-zip unvalidated symlink path traversal)
High
- Category
- Supply Chain
- Confidence
- 93% confidence
- Finding
extract-zip 2.0.1 is present as a transitive dev dependency of @puppeteer/browsers and is used for archive extraction, a high-risk operation when handling downloaded browser packages. Symlink/path traversal bugs in archive extraction can lead to arbitrary file overwrite during install or browser-download workflows if a malicious archive or compromised upstream source is processed.
- Content
Known Vulnerable Dependency: ip-address==10.1.0 — 2 advisory(ies): CVE-2026-69192 (ip-address: Address4 decodes leading-zero octets as decimal while resolvers deco); CVE-2026-42338 (ip-address has XSS in Address6 HTML-emitting methods)
High
- Category
- Supply Chain
- Confidence
- 80% confidence
- Finding
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
- Content
Known Vulnerable Dependency: ws==8.19.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)
High
- Category
- Supply Chain
- Confidence
- 80% confidence
- Finding
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js } /** * Patch @steipete/sweet-cookie keychain timeout bug. * * Published v0.1.0 hardcodes `timeoutMs: 3_000` in chromeSqliteMac.js, * ignoring the caller's value. The macOS `security` CLI often needs >3s
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js } /** * Patch @steipete/sweet-cookie keychain timeout bug. * * Published v0.1.0 hardcodes `timeoutMs: 3_000` in chromeSqliteMac.js, * ignoring the caller's value. The macOS `security` CLI often needs >3s
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js } /** * Patch @steipete/sweet-cookie keychain timeout bug. * * Published v0.1.0 hardcodes `timeoutMs: 3_000` in chromeSqliteMac.js, * ignoring the caller's value. The macOS `security` CLI often needs >3s
Static analysis
Detected: suspicious.dangerous_exec
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- src/lib/cdp-cookies.ts:173