rockingland-trader-monitor

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:35 AM UTC
• Version: 1.0.0

Overview

This skill is a real Xiaohongshu monitoring helper, but it also exposes broader authenticated account-control capabilities and weakly protects session cookies and local services.

Review this carefully before installing. Use it only on a trusted single-user machine, protect the Xiaohongshu cookies like passwords, avoid running it as root, do not expose port 18060, and prefer a version that binds only to loopback, authenticates MCP calls, removes write/publish tools from the monitoring helper, stores cookies in a private directory, and verifies downloaded binaries.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: start-mcp.sh:132

Finding

Unauthenticated MCP Service May Be Exposed on All Network Interfaces

Content

View full analysis

"$LOG_FILE" 2>&1 & else nohup "$XHS_MCP" -port ":${PORT}" > "$LOG_FILE" 2>&1 & fi ``` The associated client invokes MCP operations without credentials: ```bash INIT_RESPONSE=$(curl --noproxy '*' -s -i -X POST "$MCP_URL" \ -H "Content-Type: application/json" \ -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"openclaw","version":"1.0"}}}') ``` ### Technical Analysis The service is launched with `-port ":${PORT}"`. In the conventional Go network address format used by the referenced MCP implementation, an address containing only `:port` listens on all available interfaces rather than exclusively on the loopback interface. No authentication token, client certificate, or other authorization mechanism is configured by these scripts. The generic MCP client only initializes a session and then submits `tools/call` requests. The documented tool set includes account-affecting operations such as publishing content, posting comments, liking or favoriting posts, and deleting cookies. Consequently, a host firewall or external network configuration becomes the only barrier preventing other systems from reaching the authenticated MCP service. ### Attack Path 1. The user starts the monitor on a host reachable by another system. 2. `xiaohongshu-mcp` listens on TCP port `18060`, potentially o ...[truncated 873 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: start-mcp.sh:75

Finding

Xvfb Is Started with Access Control Disabled

Content

View full analysis

/dev/null 2>&1 & echo $! > "$XVFB_PID_FILE" ``` ### Technical Analysis The `-ac` option disables X server access control. Any local process capable of reaching the selected X11 display can attempt to connect without presenting an Xauthority credential. The virtual display is used by the browser automation component that operates with the user's Xiaohongshu authentication cookies. X11 clients can potentially inspect windows, capture displayed content, synthesize keyboard or mouse events, or otherwise interfere with clients attached to the same display. Selecting a display number from a predictable range (`:99` through `:109`) further simplifies discovery by a local attacker. ### Attack Path 1. The monitoring script starts Xvfb with `-ac`. 2. An authenticated browser is launched on the selected virtual display. 3. A malicious local process enumerates or attempts the predictable display numbers `:99` through `:109`. 4. Because access control is disabled, the process connects without an Xauthority cookie. 5. The process observes the browser display or injects input into the browser session. 6. The attacker uses the browser's authenticated state to view sensitive information or cause account actions. ### Impact Assessment The issue crosses a local-user isolation boundary. Another local user or compromised local service may be able to observe or manipulate the authenticated browser session. Depending on the browser state and available pages, this could expose account information, facilitate unauthorized account actions, or disclose authentication-related data. It does not directly provide root privileges. ]]>

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: start-mcp.sh:13

Finding

Authentication Cookies Are Stored in a Predictable Shared Temporary File

Content

View full analysis

$COOKIES_DST" fi else [ -f "$COOKIES_DST" ] && chmod 600 "$COOKIES_DST" fi } ``` The shutdown helper does not remove `/tmp/cookies.json`. ### Technical Analysis The script copies sensitive browser cookies to the fixed global path `/tmp/cookies.json`. Although mode `0600` is requested, the pathname is predictable and shared across all users and all executions. The script only replaces the destination when the source appears newer. A pre-existing destination may therefore survive and be consumed by the MCP process. The same fixed destination also creates collisions between concurrent users or monitor instances. The cookie file remains in `/tmp` after the MCP service stops. This unnecessarily extends the lifetime of reusable authentication material. File mode alone does not address stale-file use, pathname collision, ownership errors, backup collection, or exposure through a more privileged process. ### Attack Path 1. A stale or deliberately pre-positioned `/tmp/cookies.json` exists before startup. 2. The monitor evaluates the source and destination timestamps. 3. If the destination appears newer, the script does not recreate it from the intended source. 4. The MCP process starts and consumes the existing ...[truncated 784 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:59

Finding

Executable Third-Party Dependencies Are Neither Pinned nor Cryptographically Verified

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: mcp-call.sh:7

Finding

Generic MCP Caller Can Transmit Sensitive Tool Arguments to an Arbitrary Plaintext Endpoint

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (35)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill is presented as content monitoring, but the documented resource set includes service start/stop scripts, PID management, and cleanup behavior that are not surfaced as privileged operational actions. Hidden infrastructure control is dangerous in agent skills because it can affect the host environment and obscure what the skill actually does beyond its user-facing purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill is presented as content monitoring, but the documented resource set includes service start/stop scripts, PID management, and cleanup behavior that are not surfaced as privileged operational actions. Hidden infrastructure control is dangerous in agent skills because it can affect the host environment and obscure what the skill actually does beyond its user-facing purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill is presented as content monitoring, but the documented resource set includes service start/stop scripts, PID management, and cleanup behavior that are not surfaced as privileged operational actions. Hidden infrastructure control is dangerous in agent skills because it can affect the host environment and obscure what the skill actually does beyond its user-facing purpose.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The helper advertises and enables many high-impact Xiaohongshu account actions, including commenting, replying, liking, favoriting, publishing content, and deleting cookies, even though the skill is described as a monitoring and notification tool. This creates a dangerous capability mismatch: any workflow or prompt that invokes the script can perform account-manipulation or posting actions far beyond read-only monitoring, increasing the risk of unauthorized actions or abuse.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The listed capabilities include explicit state-changing and account-manipulation operations such as post_comment_to_feed, reply_comment_in_feed, like_feed, favorite_feed, publish_content, publish_with_video, and delete_cookies. For a keyword monitoring notifier, these functions are unjustified and materially increase the blast radius if the skill is misused, compromised, or prompted into taking unintended actions on behalf of the user account.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

The script deletes X lock/socket paths in /tmp based on contents of predictable files without stronger ownership and type checks, creating risk on multi-user systems where /tmp is attacker-influenced. Although the display number range is constrained, interacting with predictable paths in shared temp space can enable interference, denial of service, or unintended file deletion if assumptions about those paths are violated.

Content

Scanner excerpt · start-mcp.sh (reported line 61)May include surrounding context.

sh

local lock_pid
        lock_pid=$(cat "/tmp/.X${d}-lock" 2>/dev/null | tr -d ' ')
        if [ -n "$lock_pid" ] && ! kill -0 "$lock_pid" 2>/dev/null; then
            rm -f "/tmp/.X${d}-lock" "/tmp/.X11-unix/X${d}" 2>/dev/null
            if [ ! -e "/tmp/.X${d}-lock" ]; then
                display_num=$d
                break

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · xhs_trader_monitor.py (reported line 61)May include surrounding context.

python

def start_mcp():
    """启动 MCP 服务"""
    env = os.environ.copy()
    env['PATH'] = '/root/.local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin'
    env['MCP_URL'] = 'http://localhost:18060/mcp'

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · xhs_trader_monitor.py (reported line 101)May include surrounding context.

python

def start_mcp():
    """启动 MCP 服务"""
    env = os.environ.copy()
    env['PATH'] = '/root/.local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin'
    env['MCP_URL'] = 'http://localhost:18060/mcp'

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · xhs_trader_monitor.py (reported line 125)May include surrounding context.

python

def start_mcp():
    """启动 MCP 服务"""
    env = os.environ.copy()
    env['PATH'] = '/root/.local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin'
    env['MCP_URL'] = 'http://localhost:18060/mcp'

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · xhs_trader_monitor.py (reported line 180)May include surrounding context.

python

def start_mcp():
    """启动 MCP 服务"""
    env = os.environ.copy()
    env['PATH'] = '/root/.local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin'
    env['MCP_URL'] = 'http://localhost:18060/mcp'

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill requests users to run shell commands, read/write local files, access environment-controlled cookie paths, and manage local binaries/processes, but it does not declare any tool scope or permissions in the skill metadata. This creates a transparency and containment gap: users and orchestrators cannot accurately assess or restrict the skill's actual capabilities before use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill instructs users to export authenticated Xiaohongshu cookies into a local JSON file, but it does not prominently warn that these cookies are equivalent to session credentials and can enable account takeover if copied or exposed. In this context, the risk is elevated because the workflow explicitly stores reusable authentication material on disk and references multiple search paths and environment-based file loading.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

md

# 1. 安装 xiaohongshu-mcp 二进制
# 从 GitHub Releases 下载对应平台文件：
# https://github.com/xpzouying/xiaohongshu-mcp/releases
mkdir -p ~/.local/bin
mv xiaohongshu-mcp-linux-amd64 ~/.local/bin/xiaohongshu-mcp
mv xiaohongshu-login-linux-amd64 ~/.local/bin/xiaohongshu-login
chmod +x ~/.local/bin/xiaohongshu-*

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This shell script presents all user-facing messages and comments in Chinese, including installation guidance and status output. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not present here.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · install-check.sh (reported line 57)May include surrounding context.

sh

echo "   https://github.com/xpzouying/xiaohongshu-mcp/releases"
    echo ""
    echo "2. 解压并安装到 ~/.local/bin/："
    echo "   mkdir -p ~/.local/bin"
    echo "   mv xiaohongshu-mcp-linux-amd64 ~/.local/bin/xiaohongshu-mcp"
    echo "   mv xiaohongshu-login-linux-amd64 ~/.local/bin/xiaohongshu-login"
    echo "   chmod +x ~/.local/bin/xiaohongshu-*"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · mcp-call.sh (reported line 52)May include surrounding context.

sh

fi

# 1. Initialize 并获取 Session ID
INIT_RESPONSE=$(curl --noproxy '*' -s -i -X POST "$MCP_URL" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"openclaw","version":"1.0"}}}')

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · mcp-call.sh (reported line 65)May include surrounding context.

sh

fi

# 2. Initialized notification
curl --noproxy '*' -s -X POST "$MCP_URL" \
  -H "Content-Type: application/json" \
  -H "Mcp-Session-Id: $SESSION_ID" \
  -d '{"jsonrpc":"2.0","method":"notifications/initialized"}' > /dev/null

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script copies authentication cookies to a fixed path in /tmp, which is a shared world-traversable location on multi-user systems and increases exposure to symlink, lifecycle, and accidental disclosure risks. Even with mode 600 on the file, storing session material in /tmp is weaker than keeping it in a private directory because other processes may interfere with predictable temp-file paths or recover remnants.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · start-mcp.sh (reported line 42)May include surrounding context.

sh

# 检查 Xvfb 是否安装
    if ! command -v Xvfb >/dev/null 2>&1; then
        echo "⚠ 未检测到桌面环境，且未安装 Xvfb。"
        echo "  请安装：sudo apt-get install -y xvfb"
        echo "  安装后重新运行本脚本即可自动配置。"
        exit 1
    fi

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · start-mcp.sh (reported line 109)May include surrounding context.

sh

fi
    else
        # 确保已有的 cookies 文件权限正确
        [ -f "$COOKIES_DST" ] && chmod 600 "$COOKIES_DST"
    fi
}

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 65% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · start-mcp.sh (reported line 149)May include surrounding context.

sh

# 启动服务
echo "启动小红书 MCP 服务..."
if [ "$HEADLESS" = "false" ]; then
    nohup "$XHS_MCP" -port ":${PORT}" -headless=false > "$LOG_FILE" 2>&1 &
else
    nohup "$XHS_MCP" -port ":${PORT}" > "$LOG_FILE" 2>&1 &
fi

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 65% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · start-mcp.sh (reported line 151)May include surrounding context.

sh

# 启动服务
echo "启动小红书 MCP 服务..."
if [ "$HEADLESS" = "false" ]; then
    nohup "$XHS_MCP" -port ":${PORT}" -headless=false > "$LOG_FILE" 2>&1 &
else
    nohup "$XHS_MCP" -port ":${PORT}" > "$LOG_FILE" 2>&1 &
fi

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

At L030 the document states '本 skill 使用 cookies 登录，不依赖二维码' ('this skill uses cookies login and does not rely on QR codes'). However, L045-L050 provide a QR-code-based first-login flow via get_login_qrcode, which directly contradicts the earlier statement rather than merely adding implementation detail.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The instructions tell users to export active Xiaohongshu session cookies and place them in predictable filesystem locations without warning that these cookies are equivalent to authentication credentials. If the file is mishandled, copied into logs/backups, or exposed to other local users or tools, an attacker could reuse the session to access the account.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest describes Xiaohongshu post monitoring and WeChat alerting, but this file also manages a local MCP service lifecycle by stopping, starting, and health-checking it via shell scripts and subprocesses. While some backend access is expected, direct process orchestration is a broader host-control capability that is not stated as part of the skill's purpose.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.