Security audit

Sayba 小红书运营全流程

Security checks across malware telemetry and agentic risk

Overview

The skill mostly matches its Xiaohongshu automation purpose, but it handles live account actions and includes setup guidance that exposes a local gateway token.

Install only if you are comfortable supervising an agent with persistent access to a Xiaohongshu account. Remove or redact the gateway token output before running the install guide, do not share terminal output from setup, and manually review every post, reply, and viral-copy draft for account, copyright, and platform-policy risk before publishing.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The script reads the gateway authentication token from local configuration and prints it directly to the terminal. This unnecessarily exposes a live credential that may be captured in terminal scrollback, screen recordings, shared logs, or shoulder-surfing, enabling unauthorized access to the local OpenClaw gateway.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The guide instructs users to fetch and execute a remote shell script in a single pipeline using curl and bash. If the upstream source, network path, or GitHub content is compromised, arbitrary code will run immediately on the user's machine with the user's privileges.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The script retrieves a gateway authentication token and displays it in plain text without any prominent warning that it is sensitive. Even if intended for local convenience, normal installation guidance should not encourage exposing credentials because users may paste output into chats, tickets, or recordings.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The README promotes autonomous posting and comment-reply automation on a real social media account without prominent warnings, confirmation requirements, or discussion of account, moderation, or irreversible publication risks. In this skill context, the capability directly affects an external platform and a live user identity, so missing safeguards materially increases the chance of unintended posts, spam-like behavior, or account enforcement.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The '爆款笔记复刻' feature is described as taking a third-party post URL, analyzing it, generating similar content, and publishing it, but the README gives no warning about copyright, plagiarism, attribution, or platform policy issues. Because this skill is explicitly designed for end-to-end Xiaohongshu operations, the lack of guardrails makes misuse more dangerous by enabling rapid imitation and republication of third-party content at scale.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The procedure instructs the agent to click reply, type content, and press the send button on a live Xiaohongshu account, but it does not explicitly warn that this publishes a public comment under the user's identity and changes account/platform state. In an agent setting, that omission increases the risk of unintended external actions, especially because the SOP is operationally detailed and could be executed with minimal additional confirmation beyond a generic '是否回复' step.

Ssd 3

High

Confidence: 99% confidence
Finding: Printing the gateway authentication token as part of the normal happy-path install flow directly leaks a sensitive credential. In the context of an ops/install skill, users are especially likely to run the script verbatim and share output while troubleshooting, which increases the chance of credential disclosure and subsequent unauthorized gateway access.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.