Security audit

Vinplezhang Xiaohongshu Publisher

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Xiaohongshu drafting and publishing helper, with expected browser-account use and no evidence of hidden code execution, exfiltration, or destructive behavior.

Install only if you want an agent to help prepare and potentially publish Xiaohongshu posts from a browser session you control. Review each draft carefully, keep per-post approval explicit, and avoid configuring cron jobs to publish without a fresh approval step.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The description and title state the skill is for creating and publishing content to 小红书, and the instructions consistently require Chinese-formatted output for drafts and publication. There is no indication that the user can choose another language or opt into this locale constraint, which creates a language/locale policy concern.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The skill explicitly says to never auto-publish and to always wait for explicit user approval, but the cron section describes scheduled daily posting via isolated agent turns. In practice, that creates an approval-bypass path where autonomous execution could publish or prepare publishing actions without a fresh human confirmation, which is especially risky for actions taken in a logged-in browser session tied to a real social media account.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The guide instructs the agent to click the publish button and verify success, but it does not require an explicit final confirmation from the user immediately before submission. In a browser-automation publishing skill, this can cause unintended public posting of draft, incorrect, or sensitive content if earlier assumptions are wrong or the page state differs from expectations.

Natural-Language Policy Violations

Medium

Confidence: 90% confidence
Finding: The document consistently prescribes Chinese-only content conventions, including Chinese title length, Chinese writing style, Chinese hashtags, and Xiaohongshu-specific Chinese post structure. This is a natural-language locale constraint presented as a requirement, but the file does not offer the user any language or locale choice or state that this limitation is optional.

Natural-Language Policy Violations

Low

Confidence: 91% confidence
Finding: The file directs the agent to notify the user with a fixed Chinese sentence, which imposes a specific language for user-facing communication. The document does not indicate that the skill is restricted to Chinese-speaking users or provide any opt-in or alternative language behavior.

Static analysis

No suspicious patterns detected.