zion-xhs-catch-skill

• Outcome: Review
• Latest audit: Jun 1, 2026 · 9:33 AM UTC
• Version: 1.0.6

Overview

This skill is a disclosed Xiaohongshu scraping tool, but it needs Review because it can auto-install browser-control software, store session and sync credentials in plaintext, and upload collected data to an external service using broad credentials.

Install only if you are comfortable with authenticated browser automation, remote WebBridge installation, local plaintext cookies/tokens, and uploading scraped XHS content and images to Howtone/Zion. Use a disposable XHS account, review the WebBridge installer separately, avoid passing tokens on the command line, keep .zion/credentials.yaml and cookies.json out of source control, and verify that sync uses only credentials from the intended project.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The documentation extends the skill from simple data collection into login persistence, cookie handling, and synchronization to a third-party platform. That scope expansion materially increases risk because it introduces credential/session storage and data exfiltration paths that are not part of a minimal scraping workflow.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The skill instructs users to install software by piping a remote script directly into bash/PowerShell, which executes unreviewed code fetched over the network. This is dangerous because any compromise of the hosting domain, CDN, TLS chain, or script content can lead to immediate arbitrary code execution on the user's machine.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The script exfiltrates collected Xiaohongshu note content and downloaded images to an external Zion BaaS, including titles, content, author identifiers, comments, URLs, and media-derived assets. In this skill context, bulk collection tooling handles third-party content at scale, so undisclosed or overly broad external synchronization materially increases privacy, compliance, and data-governance risk.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The code searches both the current project and a sibling project for .zion/credentials.yaml, then extracts an admin token for outbound API requests. Reading credentials from a neighboring project exceeds the expected scope of a data-collection skill and can silently reuse unrelated secrets, enabling unauthorized data access or transmission if the script is run in a developer workspace containing other projects.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The script automatically downloads and executes a remote installer script (`install.sh | bash` / PowerShell `iex`) when WebBridge is missing. This grants arbitrary code execution from a network source without integrity verification, pinning, or user confirmation, which is far broader than data collection and creates a serious supply-chain compromise path.

Context-Inappropriate Capability

Medium

• Confidence: 85% confidence
• Finding: The script starts and manages a local background WebBridge service automatically, expanding its privileges from scraping into local environment control. While this may be intended for convenience, silently launching services can surprise users, increase attack surface, and enable broader browser-control capabilities than the skill description implies.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The script adds a credential-handling capability for a third-party Howtone sync token even though the skill is primarily described as an XHS data collection tool. Introducing token persistence expands the trust boundary and creates unnecessary secret-management risk, especially because the token is written locally in a predictable path without any apparent access controls or minimization.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill advertises synchronization of collected data to a third-party service but does not prominently warn about privacy implications, data categories transferred, retention, or user consent requirements. In context, the data includes user-generated content, author identifiers, comments, and image URLs, so silent or weakly disclosed external transfer increases privacy and compliance risk.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The script saves the full browser cookie jar for xiaohongshu.com to a plaintext cookies.json file in the current working directory, and the console messaging does not clearly warn that authenticated session tokens will be persisted locally. If that file is accessed by another local user, committed to source control, or collected by malware, an attacker may be able to reuse the session and impersonate the account.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script reads a sensitive credential file and uses an admin token to perform authenticated network requests without any user-facing disclosure or permission check. In a scraping/sync skill, silent use of high-privilege credentials is dangerous because it can move collected data into privileged backend systems without informed operator consent and broadens the blast radius if the token is misused.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: Auto-downloading and executing remote install scripts without an explicit confirmation prompt is unsafe because it performs privileged system changes and arbitrary code execution as a side effect of running the crawler. If the remote host, CDN, or installer is compromised, users can be infected immediately.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script accepts a sensitive sync token from the command line and persists it to disk without warning the user that the value is a credential or that it will remain in local storage. This increases the chance of accidental exposure through shell history, backups, shared workspaces, or local compromise, and users may not understand the persistence and sensitivity implications.

Ssd 3

Medium

• Confidence: 92% confidence
• Finding: The instructions tell operators to save and reuse a synchronization token for later uploads, but do not describe secure storage, scoping, expiration, or revocation. Poor token hygiene can expose the third-party account and enable unauthorized data uploads or access if the token is leaked through logs, shell history, files, or screenshots.

Credential Access

High

• Category: Privilege Escalation

Content

/**
 * Zion 凭证保存脚本
 * 直接接收用户提供的「好痛 Howtone」同步 Token，并保存到 .zion/credentials.yaml
 * 
 * 用法:
 *   npx ts-node zion-login.ts --token="你的同步Token"

• Confidence: 96% confidence
• Finding: credentials.yaml

Credential Access

High

• Category: Privilege Escalation

Content

import * as path from 'path';

const PROJECT_EX_ID = 'rmLyJ0ZJXK8';
const CRED_PATH = path.resolve(process.cwd(), '.zion', 'credentials.yaml');

function decodeJwt(token: string): any {
  try {

• Confidence: 97% confidence
• Finding: credentials.yaml

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/webbridge-crawl.ts:27