ClawHub
Back to skill

Security audit

Xiaohongshu Video Finder

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward browser workflow for finding Xiaohongshu video links, with token and login-session behavior disclosed and aligned with that purpose.

Before installing, understand that Xiaohongshu URLs and share links may include temporary tokens or sharing metadata. Paste them only into tools you trust, and use a separate managed browser profile if you do not want your Xiaohongshu login session reused later.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The skill explicitly tells users to rely on a share link that is auto-copied to the clipboard, but it does not warn that clipboard contents can contain sensitive tracking parameters or that replacing the user's clipboard may expose data if pasted into the wrong destination. In this context, the copied link may include identifiers and share metadata, and the lack of any privacy guidance makes accidental disclosure more likely.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.