小红书智能排期发布器

• Outcome: Review
• Latest audit: May 29, 2026 · 9:29 PM UTC
• Version: 1.0.0

Overview

The skill appears to be a real Xiaohongshu scheduler, but it needs review because it can automatically publish queued posts from a logged-in account and send status data to external notification services.

Install only if you are comfortable granting an automation tool the ability to publish Xiaohongshu posts from your logged-in account. Review the queue before starting the scheduler, use conservative rate limits, configure webhooks only to destinations you control, and inspect or pin the external xiaohongshu-mcp service and Python dependencies before using it with a real account.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill describes capabilities that imply local file access and network communication, including reading image paths, talking to a localhost MCP service, and sending webhook notifications, but it does not declare corresponding permissions. This creates a transparency and least-privilege problem: users and host systems cannot accurately assess what the skill may access or transmit, increasing the risk of unintended file exposure or network egress.

Context-Inappropriate Capability

Medium

• Confidence: 81% confidence
• Finding: The standalone CLI allows an operator or downstream automation to send arbitrary user-supplied content to external webhooks and Telegram chats, turning this file into a generic message exfiltration or spam utility. In an agent-skill context, functionality that can transmit unrestricted content outside the declared workflow increases abuse potential because it is decoupled from Xiaohongshu publish events and lacks policy checks, destination allowlisting, or content constraints.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill states that content will be saved to a local queue database and later published automatically, but it does not clearly warn users about persistent storage of post content, media paths, and scheduling metadata, nor about the consequences of autonomous posting. In a social-media automation context, silent persistence and unattended publication can lead to privacy issues, accidental posting, or reputational harm if queued content is outdated or incorrect.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill allows Feishu or DingTalk webhook notifications without warning that publication status, task identifiers, timing, and possibly account-related metadata may be sent to third-party services outside the local environment. This is a privacy and data-sharing risk, especially because operational details about posting activity may be exposed to external endpoints controlled by the user or misconfigured to unintended recipients.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The code performs a direct POST to a publishing endpoint using user-supplied title, content, and file paths with no explicit confirmation, dry-run mode, or safeguard for irreversible posting. In an agent setting, this increases the risk of unintended or unauthorized publication if upstream prompting, parameter handling, or user intent is ambiguous.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.28.0
pyyaml>=6.0
python-dateutil>=2.8.0

• Confidence: 94% confidence
• Finding: The dependency is specified with a lower bound only, which allows future installs to resolve to any newer version, including versions with breaking changes or newly introduced vulnerabilities. In a scheduler that automates authenticated publishing, dependency drift can affect reliability and may pull in a compromised or vulnerable package version during deployment.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.28.0
pyyaml>=6.0
python-dateutil>=2.8.0

• Confidence: 97% confidence
• Finding: Using an unpinned PyYAML version is especially risky because this package has a history of unsafe deserialization issues. A floating version constraint can cause deployments to pick up an unexpected vulnerable release or behavior change, which is more dangerous in an automation skill that may process queued content or configuration files without close human review.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.28.0
pyyaml>=6.0
python-dateutil>=2.8.0

• Confidence: 90% confidence
• Finding: An unpinned python-dateutil dependency creates supply-chain and reproducibility risk because installs can silently change over time. While this package is less commonly associated with critical exploitation than PyYAML, uncontrolled upgrades can still introduce vulnerable or incompatible versions into an automated publishing workflow.

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High

• Category: Supply Chain
• Confidence: 92% confidence
• Finding: The requirements file permits installation of requests versions affected by multiple published advisories because the constraint only sets a minimum version and does not exclude vulnerable ranges. In a tool that likely performs authenticated outbound HTTP requests to publish content, requests flaws can expose credentials, weaken transport verification, or leak sensitive request data.

Known Vulnerable Dependency: pyyaml — 8 advisory(ies): CVE-2019-20477 (Deserialization of Untrusted Data in PyYAML); CVE-2020-1747 (Improper Input Validation in PyYAML); CVE-2020-14343 (Improper Input Validation in PyYAML) +5 more

Critical

• Category: Supply Chain
• Confidence: 98% confidence
• Finding: The requirements file allows PyYAML versions with known critical deserialization and input-validation vulnerabilities, and PyYAML's historical risk profile makes this particularly serious. If the skill ingests YAML-based configuration, schedules, templates, or imported content, an unsafe or vulnerable PyYAML version could enable code execution or malicious payload processing with the permissions of the publishing agent.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.