Security audit
Security checks for vulnerabilities and agentic risk
The skill mostly matches its Xiaohongshu content-automation purpose, but it uses authenticated browser automation and has under-scoped credential and network handling that users should review before installing.
Install only if you are comfortable letting this skill control a logged-in Xiaohongshu creator session through the local OpenClaw browser. Keep any MiniMax configuration pointed only at the official API, avoid untrusted config or content files, review drafts before publishing, and clear generated images or temporary screenshots if they contain sensitive material.
scripts/generate_image.py:43Credential-bearing MiniMax requests can be redirected to an arbitrary configured endpoint
scripts/generate_image_smart.js:420Unrestricted image URL retrieval enables blind SSRF-like requests and unbounded downloads
scripts/upload_auto.js:375Unescaped content is assigned to innerHTML in an authenticated creator session
' + lines.join('
') + '
The README explicitly advertises automatic QR-code login behavior but does not warn users about the privacy and account-security implications of automating an authentication flow. In the context of a tool that uploads content to a real social-media account, this can mislead users into granting browser automation access to authenticated sessions, cookies, or login state without informed consent.
SQP-3 applies to all file types and includes language/locale policy violations. The skill is presented entirely in Chinese and includes fixed Chinese interaction wording such as replying with "发布" or "否", but it does not offer user language opt-in or explain that the skill is intentionally limited to a Chinese-language, region-specific workflow.
The skill explicitly describes automated QR-code login prompting, browser automation, image URL extraction, and automatic download/save behavior without clear consent gates, privacy disclosure, or system-effect warnings. In a skill that drives a real creator account and writes files locally, these actions can expose account/session data, trigger unintended platform actions, or save untrusted remote content to disk without the user fully understanding the consequences.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
print(f" 数量: {n}")
try:
response = requests.post(url, headers=headers, json=data, timeout=120)
response.raise_for_status()
result = response.json()
The script automatically connects to a local browser via CDP, opens an external site, submits user-provided prompts, and then downloads generated images to disk without any explicit consent or warning at the point of action. This creates a privacy and safety risk because sensitive prompts may be transmitted to third-party services and files may be created locally as a side effect the user did not knowingly approve.
The top-level title '小红书草稿自动化发布脚本' suggests automated publishing, yet the workflow clicks '暂存离开', reports that the draft was saved, and never clicks a publish control. This is a direct intent mismatch in the file's own documentation/name versus implemented behavior.
The header comments and help text describe behavior around publishing after draft save, implying an automated follow-up publish capability. In practice, after saving the draft the script only prints a prompt, returns awaitingPublish=true, and exits with code 42 without implementing any publish step in this file.
The logger hard-codes the locale to 'zh-CN', and the rest of the script's user-facing help and prompts are entirely in Chinese. This imposes a specific language/locale on all users without offering a choice or explaining a region-specific requirement, which matches the language/locale policy violation criteria.
Natural-language policy violations include forcing a specific language without user opt-in. This README is entirely Chinese-language and does not indicate that the skill is region-specific or provide an alternative language option, which can amount to an undocumented language constraint.
This markdown file presents all headings, instructions, and examples exclusively in Chinese. Under the policy rules, forcing a specific language without user opt-in can be a natural-language policy violation when no language choice or justification is provided.
This markdown file contains natural-language instructions and examples exclusively in Chinese, which can amount to a language/locale constraint. The policy requires either user choice or a clearly documented justification for restricting the skill to a specific language or locale, neither of which appears in the file.
This markdown file contains user-facing instructional content solely in Chinese, but does not indicate that the skill or reference is language-specific or provide any opt-in for locale preference. Under the policy, forcing a specific language without user choice can be a natural-language policy violation unless the locale constraint is documented and justified.
The script’s docstring, CLI help text, and runtime messages are all hard-coded in Chinese, including usage guidance and error output. This creates a locale policy concern because the skill forces a specific language without any user opt-in or documented justification.
The logging timestamp is explicitly formatted with the zh-CN locale, which hard-codes a language/locale choice into the skill behavior. The file does not provide an opt-in, configuration, or justification for restricting locale formatting to Chinese.
This shell script presents all user-facing messages and instructions in Chinese, including errors, warnings, and next steps. That creates a language/locale policy concern because the skill appears to force a specific language without user opt-in or a stated regional limitation.
No suspicious patterns detected.