Security audit

xhs-image-note-release

Security checks across malware telemetry and agentic risk

Overview

This skill does what it says, but it can publish directly to a live Xiaohongshu account without a final confirmation step.

Install only if you are comfortable letting an agent use your logged-in Xiaohongshu browser session to publish posts. Review the title, body, images, account, visibility settings, and rate limits yourself before running it; a safer version should add an explicit final confirmation or dry-run mode before calling _onPublish().

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The README advertises a fully automated workflow that uploads content, fills fields, publishes, and performs cleanup, but it does not warn users that the skill will take data-affecting actions on a live social-media account. In this context, the omission is risky because users or downstream agents may invoke the skill without realizing it will create public posts and trigger irreversible account activity.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The trigger scope is broad enough to activate on general requests about Xiaohongshu posting, including ambiguous intents like drafting, discussing, or preparing content rather than actually publishing it. Because this skill performs real account actions, over-broad matching increases the chance of unintended post creation or publication under the user's logged-in account.

Missing User Warnings

High

Confidence: 96% confidence
Finding: This skill automates an irreversible external action—publishing content to a live social-media account—but does not require a clear user warning or final confirmation before triggering `_onPublish()`. In context, this is more dangerous because the skill is specifically designed to bypass normal UI friction and directly invoke an internal publish method, making accidental or premature posting more likely.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The document instructs the agent to bypass normal UI interaction and directly invoke an internal publish method, causing an immediate external side effect without an explicit user confirmation or final review step. In a content-publishing skill, this increases the risk of accidental posting, misuse by prompt injection, or unauthorized publication under the user's authenticated account.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The script invokes the publish action directly via the page component's internal _onPublish() method without any explicit final confirmation, dry-run mode, or user approval gate immediately before making the post public. In an automation skill whose purpose is posting to a live social media account, this increases the risk of accidental or unauthorized publication if inputs are wrong, the wrong account is logged in, or the skill is triggered unintentionally.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.