T09 · Insecure Skill Coding Practices
- Location
scripts/run_ops_once.js:49- Finding
Configured Review Requirement Is Bypassed by the One-Shot Publishing Workflow
- Content
View full analysis
Vulnerability Details
File Location:
scripts/run_ops_once.js:5-6, 49-54; final publication occurs inscripts/xhs_independent_publish.js:83-84
Vulnerability Type: Missing authorization and confirmation enforcement
Risk Level: HighVulnerable Code
scripts/run_ops_once.jsreads the profile but does not enforce itsreviewBeforePublishpreference:js const profilePath = path.join(process.cwd(), 'data/xiaohongshu/profile.json'); const profile = JSON.parse(fs.readFileSync(profilePath, 'utf8'));It then unconditionally invokes the direct-publishing script:
js const publish = spawnSync('node', [ path.join(opsScriptDir, 'xhs_independent_publish.js'), '--asset-dir', path.join(outDir, 'png'), '--title', shortenTitle(post.title, 20), '--body', post.body ], { stdio: 'inherit' });The invoked script clicks the final publication control:
js await page.waitForSelector(selector, { timeout: 20000 }); await page.click(selector);Technical Analysis
The profile is intended to control whether human review is required before publication. Although
run_ops_once.jsloads that profile, it never evaluatesprofile.reviewBeforePublish. Instead, it always invokesxhs_independent_publish.js, which uploads the assets, fills the post, and clicks the final publish button.This is an authorization-state enforcement flaw: a security-relevant preference is stored but not checked at the point where the irreversible external action occurs. It also contradicts the declared rule in
SKILL.mdthat execution must stop for review when the profile requires review.The repository contains a safer review-only implementation in
scripts/xhs_publish.js, which fills the draft and stops without clicking the publication button. The one-shot workflow does not select that safer path based on the profile.Attack Path
- The operating profile is configured with `reviewBeforePubl ...[truncated 1090 chars]
- Remediation
View remediation
Remediation Suggestions
- Enforce
profile.reviewBeforePublishbefore invoking any publisher:js if (profile.reviewBeforePublish) { console.log('READY_FOR_REVIEW'); console.log(`Draft assets: ${outDir}`); process.exit(0); } - When review is required, use the review-only workflow in
scripts/xhs_publish.jsor stop after asset generation. - Require an explicit, non-default
--confirm-publishflag immediately before the final click. - Add the same confirmation check inside
xhs_independent_publish.jsso direct invocation cannot bypass the policy. - Keep preparation and publication as separate commands. The preparation command should never perform the irreversible action.
- Add automated tests covering both
reviewBeforePublish: trueandfalse. - Fail closed if the profile field is absent, malformed, or cannot be read.
- Log the selected publication mode without exposing authenticated browser data.
- Enforce