Super Xiaohongshu Mcp Skill 1.0.0

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:53 AM UTC
• Version: 1.0.0

Overview

The skill is mostly coherent for managing a Xiaohongshu account, but it asks users to run an unverified native binary and enables live account actions with limited safeguards.

Review this skill carefully before installing. Use it only if you trust the upstream xiaohongshu-mcp binary source, verify release artifacts yourself where possible, store cookies.json in a private directory with restrictive permissions, and require explicit confirmation before any publish, comment, like, favorite, cookie deletion, or bulk interaction action.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Warning

• Location: references/deploy.md:16

Finding

Unpinned and Unverified Third-Party Binary Download and Execution

Content

View full analysis

mcp.log 2>&1 & echo $! > mcp.pid ``` ### Technical Analysis The deployment procedure downloads a precompiled executable from a third-party GitHub release and runs it with the current user's privileges. The command does not pin a reviewed release tag, commit, or immutable artifact identifier. It also performs no checksum, signature, provenance, or publisher verification before extraction and execution. Consequently, the effective executable payload can change after the Skill documentation has been reviewed. A compromised upstream maintainer account, release workflow, repository, or downloadable release asset could substitute malicious code. The use of GitHub as the disclosed source does not by itself establish artifact integrity. Extracting the archive before validating its contents also creates an additional archive-safety concern. A malicious archive could potentially contain unexpected paths or files in addition to the documented executables. ### Attack Path 1. An attacker compromises the upstream repository, maintainer credentials, release pipeline, or release asset. 2. The attacker publishes or replaces an artifact matching the broad filename pattern used by the deployment command. 3. A user ...[truncated 1251 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: references/deploy.md:29

Finding

Reusable Authentication Cookies Stored Without Documented Access Controls

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (15)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest description includes unrelated, ambiguous trigger text such as random-looking keywords appended to the skill summary. This can cause the agent to invoke the skill in inappropriate contexts, increasing the chance of unintended access to account-affecting functions like posting, liking, or commenting on Xiaohongshu.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill description advertises powerful account operations including publishing, commenting, liking, favoriting, and cookie deletion without warning that these actions can modify user accounts or create external platform activity. In an agent setting, this raises the risk of accidental destructive or reputation-impacting actions being taken without informed user consent.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

1. 检查服务状态

   bash

   curl -s -X POST http://localhost:18060/mcp \
     -H "Content-Type: application/json" \
     -d '{"jsonrpc":"2.0","method":"initialize","params":{},"id":1}'
   

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/deploy.md (reported line 56)May include surrounding context.

1. 检查服务状态

   bash

   curl -s -X POST http://localhost:18060/mcp \
     -H "Content-Type: application/json" \
     -d '{"jsonrpc":"2.0","method":"initialize","params":{},"id":1}'
   

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 65% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

2. 服务未运行时启动

   bash

   cd /Users/handi7/Documents/agentic-coding-projects/projects/xiaohongshu-mcp
   nohup ./bin/xiaohongshu-mcp-darwin-arm64 > mcp.log 2>&1 &
   

可用工具

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 65% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/deploy.md (reported line 44)May include surrounding context.

2. 服务未运行时启动

   bash

   cd /Users/handi7/Documents/agentic-coding-projects/projects/xiaohongshu-mcp
   nohup ./bin/xiaohongshu-mcp-darwin-arm64 > mcp.log 2>&1 &
   

可用工具

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 65% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/deploy.md (reported line 48)May include surrounding context.

2. 服务未运行时启动

   bash

   cd /Users/handi7/Documents/agentic-coding-projects/projects/xiaohongshu-mcp
   nohup ./bin/xiaohongshu-mcp-darwin-arm64 > mcp.log 2>&1 &
   

可用工具

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 65% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/deploy.md (reported line 87)May include surrounding context.

2. 服务未运行时启动

   bash

   cd /Users/handi7/Documents/agentic-coding-projects/projects/xiaohongshu-mcp
   nohup ./bin/xiaohongshu-mcp-darwin-arm64 > mcp.log 2>&1 &
   

可用工具

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 65% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/deploy.md (reported line 94)May include surrounding context.

2. 服务未运行时启动

   bash

   cd /Users/handi7/Documents/agentic-coding-projects/projects/xiaohongshu-mcp
   nohup ./bin/xiaohongshu-mcp-darwin-arm64 > mcp.log 2>&1 &
   

可用工具

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/deploy.md (reported line 20)May include surrounding context.

md

# macOS ARM64
gh release download --repo xpzouying/xiaohongshu-mcp \
  --pattern "xiaohongshu-mcp-darwin-arm64.tar.gz" --dir /tmp
mkdir -p ~/xiaohongshu-mcp/bin
tar -xzf /tmp/xiaohongshu-mcp-darwin-arm64.tar.gz -C ~/xiaohongshu-mcp/bin/

# macOS Intel: xiaohongshu-mcp-darwin-amd64.tar.gz

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The guide states that cookies.json is saved locally and reused for future logins, but it does not warn that this file is effectively an authenticated session token for the Xiaohongshu account. If the file is readable by other local users, copied into backups, or committed accidentally, an attacker could hijack the account without needing credentials.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The guide documents tools that can publish content and perform account-affecting interactions, but it does not clearly warn that these actions execute on a real logged-in Xiaohongshu account and may create irreversible external side effects. In a social-media automation skill, omission of explicit safety warnings increases the chance of accidental posting, engagement manipulation, or policy-violating use by an agent or user.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The bulk interaction workflow explicitly suggests iterating over feeds to like, favorite, or comment, but it provides no warning that this can trigger repeated real actions at scale on a live account. In context, this makes accidental spam, engagement automation, account enforcement, or reputational harm substantially more likely.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The skill body is presented solely in Chinese ("小红书 MCP 服务操作。") with no indication that users may choose another language or locale. Because policy violations can arise from forcing a specific language without opt-in, this should be documented as a language constraint or made optional.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

A natural-language policy violation applies here because the skill content effectively forces a specific language without user opt-in or justification. There is no indication that the skill is region-specific or that alternate language support is intentionally limited.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.