Security audit

小红书 MCP 服务

Security checks for vulnerabilities and agentic risk

Overview

The skill does automate Xiaohongshu, but it ships account cookies and exposes account-changing tools too broadly, so it needs careful review before use.

Do not install or run this version against any real account until the bundled cookies are removed and rotated, the package excludes credential data, the MCP server binds only to localhost or requires strong authentication, and publish/comment/delete actions require explicit user approval. Treat any included Xiaohongshu session as exposed.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (7)

T09 · Insecure Skill Coding Practices

Error

Location: data/cookies.json:1
Finding: Authentication credentials and session tokens are distributed with the package
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/index.js:331
Finding: Unauthenticated MCP service exposes account-control operations on all network interfaces
Content: View full analysis
{ console.error(`\nReceived request: ${req.method} ${req.url}`); console.error('Content-Type:', req.headers['content-type']); console.error('Accept:', req.headers.accept); try { await transport.handleRequest(req, res); } catch (error) { if (!res.headersSent) { res.status(500).json({ jsonrpc: '2.0', error: { code: -32603, message: error.message, data: error.stack, }, id: null, }); } } }); ``` ```javascript app.listen(PORT, HOST, () => { // Service is now reachable through the configured host and port. }); ``` ### Technical Analysis The default host is `0.0.0.0`, so the MCP service listens on every available interface rather than only the loopback interface. The `/mcp` handler forwards requests directly to the MCP transport without authenticating the caller or authorizing individual tools. No bearer-token validation, mutual TLS, session-level access policy, trusted-origin check, CSRF protection, or rate limiting is implemented. The registered tool set includes sensitive account-changing operations such as: - Deleting authentication cookies - Posting and replying to comments - Liking and favoriting content - Publishing images and videos Because the Puppeteer browser automatically loads the account cookies, remote MCP callers inherit the authenticated account context. The alternat ...[truncated 1063 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/xhs-tools.js:536
Finding: Caller-controlled local file paths are uploaded without path restrictions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/browser.js:33
Finding: Chromium sandbox, same-origin enforcement, and site isolation are disabled
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/browser.js:81
Finding: Authentication cookies are stored in plaintext without explicit restrictive permissions
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: package.json:31
Finding: Dependency versions are mutable and installations are not reproducible
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/ensure-service.js:70
Finding: Service shutdown command can forcibly terminate unrelated Node.js processes
Content: View full analysis
{ exec('taskkill /F /IM node.exe /FI "WINDOWTITLE eq *xhs*"', (error) => { if (error) { console.log('No running service was found'); } else { console.log('Service stopped'); } resolve(!error); }); }); } ``` ### Technical Analysis The stop routine does not retain the process identifier created by `spawn`. Instead, it invokes `taskkill` against `node.exe` and relies on a wildcard window-title filter. The `/F` option forcibly terminates matching processes. Process names and window titles are not reliable ownership identifiers. An unrelated Node.js process whose title matches the pattern can therefore be terminated. Forced termination also bypasses graceful cleanup and can corrupt in-progress work. The command string is static, so this is not a command-injection vulnerability. The issue is the excessive scope and force of the termination operation. ### Attack Path 1. An unrelated Node.js process runs with a window title matching the wildcard filter. 2. A user or automation executes `node scripts/ensure-service.js stop`. 3. `taskkill` searches broadly for matching `node.exe` processes. 4. Matching processes are forcibly terminated, including processes not created by this project. 5. Those applications may lose state or become unavailable. ### Impact Assessment The issue can cause local denial of service, interruption of unrelated Node.js applications, and data loss where a process is terminated during a write or transaction. It does not directly provide additional privileges because the command runs with the current user's existing permissions. ]]>
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (45)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The description promises a comprehensive Xiaohongshu automation assistant with full XHS operational abilities and an MCP server. However, this code chunk is a progressive/test MCP server that mainly initializes transport, exposes /mcp and /health endpoints, registers a basic ping tool, and optionally a check_login_status tool from another file. Based on the supplied code alone, the implemented behavior is limited to server scaffolding and login-status checking, not full RED/XHS actions like posting notes, searching notes, or operations management. This is a material underimplementation relative to the declared purpose, so it is a mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: The declared description presents a full Xiaohongshu automation assistant with broad platform operation capabilities and an MCP server. The supplied code chunk does not implement any XHS-specific logic, API interaction, browser automation, note management, or server behavior. Instead, it is a generic utilities module. While utility code can support a larger XHS tool, this chunk by itself does not accurately represent the declared purpose and is materially more limited than described.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.
md
import { searchFeeds, likeFeed, publishContent } from './scripts/xhs-tools.js';

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.
md
import { searchFeeds, likeFeed, publishContent } from './scripts/xhs-tools.js';

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.
md
import { searchFeeds, likeFeed, publishContent } from './scripts/xhs-tools.js';

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The file contains live authenticated Xiaohongshu session material, including access tokens, session identifiers, and account-linked cookies that can enable unauthorized access to the associated account. Bundling these secrets inside a distributable automation skill is dangerous because anyone who obtains the skill files may reuse the session to act as the account owner, exfiltrate data, or perform posting and account-management actions.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The publishing functions can create public posts and upload local files, yet the documentation lacks warnings about visibility, permanence, and the sensitivity of local file paths/content being transmitted. In the context of an XHS automation skill, this is particularly dangerous because a mistaken invocation can immediately disclose private media or publish unintended content to a wide audience.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This publication tool can create real posts and accepts image inputs from either HTTP URLs or local absolute paths, increasing risk beyond ordinary posting. In an agent context, that combination can lead to unintended public publication and possible local file disclosure or unauthorized use of remote content if upstream validation is weak.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This tool uploads a local video file and publishes content directly to an external social-media platform without any explicit warning or confirmation mechanism. Because it operates on local absolute paths, an agent could be induced to exfiltrate sensitive local media and publish it under the user's account, causing both data exposure and reputational damage.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This function posts a comment directly to an external platform using the currently authenticated account without any confirmation, preview, or policy guard. In an agent-driven environment, unreviewed content submission can cause account abuse, spam, reputational damage, or accidental disclosure if triggered by prompt injection or ambiguous user instructions.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This workflow replies to another user's comment using the logged-in account with no confirmation or preview of the outbound message. Because it performs an external side effect tied to a real identity, it is vulnerable to misuse by malicious prompts, unintended automation, or social-engineering chains that cause unauthorized posting.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The publishing workflow uploads local image files and publishes a post to Xiaohongshu immediately after form filling, without explicit user approval at the point of no return. This creates a serious risk of accidental public posting, sensitive file disclosure, reputational harm, and abuse through prompt injection because both local data exfiltration and public account actions are involved.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This function uploads a local video file and publishes it externally without a confirmation checkpoint, combining local file access with irreversible external account actions. In the context of a social-media automation skill, that significantly increases the danger of private media leakage, unauthorized posting, and account misuse from unsafe or manipulated prompts.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 85% confidence
Finding: The skill advertises executable setup and service behavior and exposes environment-variable-based configuration, but it does not declare any tool scope or permission boundaries. In an agent setting, missing scope metadata can allow broader-than-expected execution context or make review and policy enforcement harder, increasing the chance of unintended access or behavior.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger condition is extremely broad, covering nearly any mention of Xiaohongshu, posting, searching, or operations, which can cause the skill to activate in ordinary conversation without clear user intent. Because the skill includes account-affecting actions and service startup behavior, accidental invocation could lead to privacy exposure, unnecessary network activity, or unintended state-changing operations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill exposes actions that modify account state—liking, favoriting, commenting, replying, and publishing—but the documentation does not require explicit user confirmation or warn about irreversible or policy-sensitive effects. In the context of a social-media automation skill, this is more dangerous because mistaken or coerced execution can directly post content, interact publicly, or alter the user's account behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The documented delete_cookies() operation destroys the active login session but provides no warning, confirmation requirement, or guidance about its irreversible effect on the current authenticated state. In an automation skill, this can lead to unintended logout, workflow disruption, and possible account recovery friction if invoked by mistake or through ambiguous user prompting.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The API exposes account-modifying actions such as liking, favoriting, commenting, and replying without any user-facing warning that they will perform live interactions on a real account. Because this skill is specifically for social-media automation, these operations can generate unintended public activity, reputational harm, spam-like behavior, or platform policy violations if triggered without clear consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The batch example performs repeated automated likes across multiple search results and keywords but does not warn that it will carry out live, repeated account actions. In a social-platform automation context, this increases the risk of accidental mass interaction, spam patterns, account restriction, and unintended manipulation of platform activity.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The stop operation uses a force-kill command (taskkill /F) against matching node.exe processes, which is a destructive action that can terminate running work. Although the script logs after execution, there is no prior warning, confirmation, or explanatory comment disclosing the risk of forcibly stopping processes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The skill exposes a cookie-deletion action as a callable tool with no confirmation, warning, or friction. In an MCP/agent setting, that can let an agent or prompt-triggered workflow silently destroy the user's authenticated session, causing denial of service for the automation and potentially forcing re-login flows at unsafe times.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file contains user-facing natural-language descriptions and runtime log messages in Chinese, such as the header comments and tool descriptions, with no indication that the skill is intended only for Chinese-speaking users or that another language option is available. This can violate language/locale policy because it effectively forces a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The server logs the full POST body for every incoming /message request, which can expose sensitive user data, MCP tool arguments, authentication material, cookies, or operational content to console logs and downstream log collectors. In this skill context, the service automates account actions for XiaoHongShu, so requests may contain private prompts, session-related data, or publishing content, making indiscriminate request logging a real confidentiality risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This tool posts comments to an external platform and performs an irreversible state-changing action with no built-in confirmation, approval gate, or user-warning mechanism in this file. In an agent-driven environment, ambiguous or prompt-injected instructions could cause unintended comments to be published from the user's authenticated account.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This reply tool can publish replies to existing comments without any explicit safety interlock or confirmation path. Because the service automates actions on a real social-media account, misuse or misinterpretation by an LLM agent could generate unwanted public interactions, reputational harm, or policy violations.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/ensure-service.js:48

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/ensure-service.js:15