redbookskills

• Outcome: Review
• Latest audit: May 29, 2026 · 9:25 PM UTC
• Version: 1.0.0

Overview

This Xiaohongshu automation skill can publish and comment from a logged-in account and read account data beyond its brief description, so it should be reviewed before installation.

Install only if you are comfortable giving the skill control of a logged-in Xiaohongshu browser session. Use a dedicated or test account/profile, prefer --preview and manual review before posting, avoid remote CDP unless you fully control the host, and treat comment posting, notification capture, and analytics export as real account-impacting actions.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (22)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

for line in result.stdout.splitlines():
                if f":{port}" in line and "LISTENING" in line:
                    pid = line.strip().split()[-1]
                    subprocess.run(
                        ["taskkill", "/F", "/PID", pid],
                        capture_output=True, timeout=5
                    )

• Confidence: 96% confidence
• Finding: This code force-kills whatever PID `netstat` reports as listening on the chosen port, without verifying that the process is the Chrome instance started by this tool. If the configured port is already used by another local service, the skill can terminate an unrelated application or security/control process, creating a local denial-of-service condition.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill clearly invokes shell commands, reads/writes local files, accesses the network, and interacts with browser/CDP state, yet no permissions are declared. That deprives users and policy layers of accurate visibility into what the skill can do and increases the risk of unintended file, network, or account actions being authorized implicitly.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented behavior substantially exceeds the declared purpose: beyond posting and test-browser launch, it supports searching content, retrieving note details, posting comments, scraping mentions/notifications, exporting analytics, and managing multiple accounts. This scope mismatch is dangerous because users may authorize a simple publishing helper while the skill can also perform surveillance, interaction, and account-management actions on their behalf.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The manifest says the skill is for publishing content and testing a browser, but the body documents additional workflows for content search, note-detail retrieval, commenting, notification scraping, and analytics export. Hidden or under-declared capabilities materially increase the chance of overbroad trust and misuse, especially where account data and live social actions are involved.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The description claims only three task types are supported, but the input-routing logic silently adds several more workflows. This inconsistency weakens informed consent and can cause an agent or user to trigger actions they would not expect from the advertised functionality.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The file exposes capabilities well beyond the declared skill scope of publishing/test-browser use, including feed search, feed detail retrieval, comment posting, notification scraping, and analytics export. Scope expansion is dangerous because users or orchestrators may grant trust based on the manifest, while the code can silently perform broader data access and engagement actions on their authenticated Xiaohongshu session.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The code includes account management operations not described in the manifest, such as adding, removing, switching, and setting default accounts. Undisclosed account-management functionality increases the attack surface and could let an agent manipulate browser profiles or authenticated contexts in ways the operator did not consent to.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code can navigate to arbitrary feed pages and post top-level comments using the logged-in user's session, which is unrelated to the stated auto-publishing purpose. In this skill context, unsolicited engagement actions are especially risky because they can be used for spam, impersonation, or reputation damage without meaningful user review.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill captures notification mentions and creator analytics from authenticated requests, which are not necessary for simple content publishing. This broadens access to potentially sensitive account data and creates a risk of covert scraping or exfiltration from a session the user only expected to use for posting content.

Context-Inappropriate Capability

Medium

• Confidence: 99% confidence
• Finding: The Windows fallback kills any process bound to the requested debugging port, not specifically the browser launched for publishing. In the context of an automation skill that may run on a user's workstation, this increases danger because a common or user-supplied port could collide with unrelated local applications and cause unintended service disruption.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The documentation states that publishing commands default to actually clicking Publish unless preview mode is enabled, but it does not present this as a prominent safety warning near the command examples. In a skill that performs live posting to a social account, unclear defaults can easily cause accidental publication of content.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The comment-posting commands perform a live social action on behalf of the user, yet the examples lack an explicit warning that they will immediately post a real comment. This is risky because comment actions are externally visible, can affect reputation, and may be triggered by an agent without the user appreciating the consequence.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The integration guide instructs an AI assistant to automatically fetch content, handle images, log into XHS accounts, and publish posts, but it does not warn about privacy exposure, accidental posting, or account-impact risks. In this skill context, the omission is more dangerous because the documented workflow explicitly encourages autonomous external-platform actions, including multi-account use and browser/login automation.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The CLI path can post comments immediately once invoked, without an interactive confirmation step or prominent disclosure of the irreversible external action. Because it operates on a live authenticated account, a mistaken or malicious upstream invocation can cause unwanted public engagement and account misuse.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The publish command automatically clicks the platform publish button after filling content, with no final confirmation or pre-action warning. Publishing is an external, often irreversible action, so lack of confirmation increases the risk of accidental posting, abuse through agent chaining, and reputational harm.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The click-publish command performs the final irreversible publish action on the current page state without validating content or requesting confirmation. In an automation context, this is especially dangerous because any prefilled draft in the browser can be unintentionally or maliciously posted under the user's account.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: This pipeline defaults to publishing unless `--preview` is explicitly supplied, and it proceeds to click the publish button without any final interactive confirmation or equivalent safeguard. In a content-posting automation skill, that creates a real risk of unintended public posting from malformed inputs, prompt injection into upstream content generation, operator mistakes, or misuse by another component invoking the CLI non-interactively.

Ssd 2

Medium

• Confidence: 95% confidence
• Finding: The instruction to use randomized, human-like interaction specifically to avoid system detection indicates deliberate stealth and evasion behavior. In the context of an automation skill for publishing to Xiaohongshu, this increases risk because it facilitates bypassing platform anti-bot controls, which can enable abusive automation, account misuse, and policy evasion at scale.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.28.0
websockets>=12.0

• Confidence: 90% confidence
• Finding: The dependency is specified with only a lower bound, which allows installation of any newer release, including versions with breaking changes or newly introduced vulnerabilities. This weakens build reproducibility and can expose the skill to supply-chain risk if the environment resolves to an unsafe version.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.28.0
websockets>=12.0

• Confidence: 90% confidence
• Finding: The websockets dependency is not pinned to an exact version, so deployments may resolve to different releases over time. That increases supply-chain exposure and makes it harder to ensure the installed version is free from known security issues.

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High

• Category: Supply Chain
• Confidence: 94% confidence
• Finding: The requirement permits requests>=2.28.0, which can resolve to vulnerable versions including releases affected by recent advisories such as credential leakage and verification-related issues. Because this skill automates network interactions for publishing content, use of a vulnerable HTTP client could expose credentials, session data, or request integrity.

Known Vulnerable Dependency: websockets — 4 advisory(ies): CVE-2018-1000518 (websockets is vulnerable to denial of service by memory exhaustion); CVE-2021-33880 (Observable Timing Discrepancy in aaugustin websockets library); CVE-2018-1000518 (aaugustin websockets version 4 contains a CWE-409: Improper Handling of Highly C) +1 more

High

• Category: Supply Chain
• Confidence: 93% confidence
• Finding: The requirement allows installation of websockets versions with known denial-of-service and side-channel related issues. In a skill that may maintain browser automation or real-time communication channels, a vulnerable websockets library could enable service disruption or leakage through protocol handling weaknesses.

VirusTotal

57/57 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.