小红书 MCP 服务
Analysis
This XHS automation skill is functional but risky because it ships with session cookies and runs an unauthenticated background MCP service that can post, comment, like, and publish through an account.
Findings (6)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
Primary credential: none
The metadata says no primary credential is required even though the artifact set includes XHS cookies and login/session handling.
server.tool('publish_content', '发布图文内容到小红书', { ... visibility: z.enum(['公开可见', '仅自己可见', '仅互关好友可见']).optional().default('公开可见') ... })The tool set directly supports public publishing and other account mutations, but the artifacts do not show an enforced confirmation step before those high-impact actions.
detached: true, stdio: 'ignore', env: { ...process.env } ... child.unref();The service manager starts the MCP server as a detached background process, allowing it to continue running after the initiating command returns.
"dependencies": { "@modelcontextprotocol/sdk": "^1.0.0", "express": "^4.18.2", "puppeteer": "^24.0.0" }The skill relies on npm-installed dependencies with floating caret ranges, while the registry provides no install spec and the source/homepage provenance is limited.
Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.
"name": "access-token-creator.xiaohongshu.com", "value": "customer.creator.AT-..."
The package contains XHS access/session cookie material, and the browser module is designed to load cookies from this data path, creating account authority that is not declared as a primary credential.
Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.
const HOST = process.env.XHS_HOST || '0.0.0.0'; ... app.all('/mcp', async (req, res) => { ... await transport.handleRequest(req, res); })The MCP endpoint is bound to all interfaces by default and the provided route handler forwards requests to the MCP transport without a local authentication or origin check.