ClawHub
Back to skill

Security audit

小红书文案专家

Security checks for vulnerabilities and agentic risk

Overview

This skill is a Chinese Xiaohongshu copywriting helper, but it can create first-person promotional posts with invented realistic details that may look like genuine customer experiences.

Review before installing if you use this for commercial or product content. It should be constrained to user-provided facts, explicit placeholders, or clearly labeled fictional/promotional drafts so it does not produce undisclosed ads or fabricated testimonials.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

other

Warning
Location
references/xiaohongshu-rules.md:61
Finding

Generation of Fabricated Firsthand Testimonials and Undisclosed Promotional Content

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:13-16, SKILL.md:30; references/xiaohongshu-rules.md:61-68, references/xiaohongshu-rules.md:106, references/xiaohongshu-rules.md:121, references/xiaohongshu-rules.md:192
Vulnerability Type: other: Deceptive Content Generation
Risk Level: Medium

Relevant Code Snippets

The following are faithful English translations of the relevant source instructions from SKILL.md:13-16:

markdown
You are a Xiaohongshu copywriting expert who writes in the style of a real
user's personal recommendation and specializes in three kinds of content
using the tone of a real person chatting with friends:

1. Product recommendations: naturally recommend products with no appearance
   of hard advertising.

The relevant requirement from SKILL.md:30 is:

markdown
- Must include a specific time, scene details, and internal thoughts.

The following are faithful English translations of the product-content requirements in references/xiaohongshu-rules.md:61-68:

markdown
- Must include how the writer learned about the product, such as a friend's
  recommendation, seeing a review, or finding it by chance.
- Must include hesitation or comparison before purchase, such as price,
  brand, or functionality.
- Must include two or three specific usage scenarios or details.
- Must include one minor product defect.
- Must include one unexpected benefit or aspect that exceeded expectations.

The fabrication-related instructions in references/xiaohongshu-rules.md:106, references/xiaohongshu-rules.md:121, and references/xiaohongshu-rules.md:192 state:

markdown
If the original text lacks a specific time, setting, or internal thoughts,
add one or two such details.

If the original text is missing obvious elements such as a minor defect or
specific details, proactively add them. If information is insufficient, a
placeholder such as 
...[truncated 2815 chars]
Remediation
View remediation

Remediation Suggestions

  1. Prohibit invented firsthand claims, including fabricated purchase histories, usage experiences, personal reactions, social interactions, defects, and results.
  2. Require factual experiential details to come directly from the user. If required information is absent, ask for it or retain explicit placeholders rather than generating plausible facts.
  3. Replace instructions to “proactively add” details with instructions to reorganize only user-provided facts.
  4. Require clear labeling such as “promotional draft,” “fictional example,” or “based on details supplied by the user” whenever applicable.
  5. Remove the requirement that product recommendations have “no appearance of hard advertising.” Instead, require transparent disclosure of promotional intent and material relationships.
  6. Add a verification checklist that distinguishes factual claims from stylistic language before producing the final output.
  7. For rewrites, preserve only facts present in the source and mark missing information with explicit placeholders.
  8. Add a refusal or clarification rule for requests to impersonate an actual customer, fabricate reviews, or conceal sponsorship.
  9. Revise examples so they do not model unverified firsthand experiences as genuine events.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The skill is written to operate only in Chinese and assumes a Chinese-language output style without checking user preference or documenting why that restriction is necessary. In multilingual environments, this can produce unintended outputs, reduce usability, and cause the system to ignore user language expectations or locale-specific safety/policy controls.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger conditions are broad enough to match generic writing or rewriting requests based on common keywords like '爆款' or '改写文案'. This can cause the skill to activate outside its intended niche, leading to misrouting, unexpected behavior, or bypass of more appropriate skills, especially in systems where skill selection influences downstream actions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The file mandates a specific language style as "朋友聊天式，完全口语化" and the entire skill is framed exclusively in Chinese, with no indication that the user can choose another language or locale. This can violate language/locale policy when the skill is used with users who have not explicitly opted into Chinese-only output.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The manifest description is entirely in Chinese and describes the skill as a 'Xiaohongshu copywriting expert' that generates platform-specific copy, but it does not indicate that language choice is optional or user-selectable. This can be a natural-language policy issue because it implicitly constrains the skill to a specific language/locale without documented opt-in or justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.