Security audit

小红书笔记批量下载

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its Xiaohongshu download purpose, but it needs review because it controls a logged-in Chrome tab and can write files outside the chosen folder from crafted note titles.

Install only if you are comfortable granting a script CDP access to a logged-in Xiaohongshu browser tab. Use a dedicated Chrome profile, close other sensitive tabs, bind debugging to localhost, run dependencies in a virtual environment, and modify the script to sanitize and containment-check note folder names before writing files.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:149
Finding: Attacker-Controlled Note Titles Can Escape the Configured Download Directory
Content: View full analysis
Remediation: View remediation
|\x00-\x1f]', '_', title).strip() safe_title = safe_title.replace("..", "_") if not safe_title: safe_title = note_id candidate = os.path.realpath(os.path.join(base_dir, safe_title)) if os.path.commonpath([base_dir, candidate]) != base_dir: raise ValueError("Unsafe note output path") note_dir = candidate os.makedirs(note_dir, exist_ok=True) ``` 5. Consider creating directories as `-` to provide uniqueness while retaining readability. 6. Apply the containment check immediately before every filesystem write as defense in depth. 7. Document that the destination should be a dedicated, non-sensitive download directory. ]]>

T08 · Insecure Dependencies

Warning

Location: SKILL.md:14
Finding: Unpinned Third-Party Dependencies Create Supply-Chain and Reproducibility Risk
Content: View full analysis
Remediation: View remediation
--hash=sha256: requests== --hash=sha256: ``` ```bash python3 -m venv .venv . .venv/bin/activate python3 -m pip install --require-hashes -r requirements.txt ``` 3. Generate the final hashes from trusted package artifacts after reviewing the selected versions and their transitive dependencies. 4. Pin transitive dependencies as well, or use a lock-generation tool that produces a complete hash-locked dependency set. 5. Use an explicitly approved HTTPS package index and avoid untrusted mirrors configured through environment variables or local `pip` configuration. 6. Warn users not to run dependency installation as root or through `sudo`. 7. Periodically review and deliberately update the pinned versions instead of automatically accepting the newest releases. ]]>

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.
在终端运行：

bash
curl -s http://127.0.0.1:9222/json | python3 -m json.tool | grep -E '"id"|"url"'

找到包含 xiaohongshu.com 的那条记录，复制其 id 值。

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The skill performs bulk downloads of third-party content and creates many local files/directories, but it does not present a clear up-front safety warning about filesystem writes, storage usage, or the implications of collecting remote content under the user's account context. This can lead users to run it without understanding the scope of local changes or data-handling risks.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill instructs the user to expose Chrome's DevTools remote debugging port and then attaches to a live authenticated tab to navigate pages and extract data. That grants broad control over the user's logged-in browser session, which is far more powerful than a narrow content-download API and can expose session data or enable unintended actions if misused or repurposed.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The natural-language content of the skill is entirely in Chinese and does not indicate that the user can choose another language or that the skill is intentionally limited to Chinese for a documented regional reason. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.