Security audit

小红书

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent, but it has an under-disclosed remote endpoint override that could send Xiaohongshu tokens or draft post content to a non-local server.

Install only if you are comfortable auditing the local MCP component yourself, using a dedicated Xiaohongshu account, and keeping the endpoint strictly local. Do not set XHS_ALLOW_REMOTE=yes or XHS_MCP_BASE_URL to a non-loopback address unless you fully trust that server and understand that tokens and draft content may be sent there. Review scripts/publish.sh only as a maintainer tool; normal users should not run it.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/xhs_client.py:41
Finding: Remote Endpoint Override Permits Transmission of Sensitive Data to Arbitrary Servers
Content: View full analysis
Remediation: View remediation
` or an explicitly approved loopback equivalent. - Reject embedded credentials, fragments, unexpected schemes, and malformed ports. - Resolve hostnames and verify that every resulting address is loopback. 3. Disable redirects for sensitive API calls: ```python resp = requests.request(method, url, allow_redirects=False, **kwargs) ``` 4. If remote operation is genuinely required: - Require HTTPS. - Maintain a narrow destination allowlist. - Consider certificate or public-key pinning. - Require conspicuous, per-operation user confirmation. - Never permit sensitive publication or token requests over plaintext HTTP. 5. Update `SKILL.md` and `SETUP.md` so their stated guarantees exactly match runtime behavior. 6. Add automated tests proving that external hosts, redirect responses, unsupported schemes, and malformed endpoint values are rejected before request data is transmitted. ]]>

T08 · Insecure Dependencies

Note

Location: SETUP.md:26
Finding: Unpinned Python Dependency Installation Creates Supply-Chain Risk
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The documented purpose is end-user Xiaohongshu operations, but the referenced behavior includes package/repository publishing and version manipulation for ClawHub distribution, which is materially different from user-facing note publishing. This mismatch can mislead operators and automated systems into granting maintainer credentials or executing release workflows under the guise of normal platform automation.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill advertises networked/local-client behavior and references environment-gated controls, but it does not declare an explicit tool scope such as allowed tools or permissions. That creates ambiguity for a host agent about whether network and environment access are expected, increasing the chance the skill is invoked with broader capabilities than necessary.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The activation description is broad enough to trigger whenever a user mentions Xiaohongshu/RedNote or wants research/publishing on that platform, without clearly constraining allowed operations or requiring stronger confirmation before sensitive actions. Overbroad triggers increase the risk of unintended skill activation, especially for publishing-capable workflows that can cause real account actions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The search command hard-codes Chinese strings for sort, type, and time choices, which imposes a specific language/locale in the user-facing interface. The file does not offer an alternative language choice or explain that the skill is intentionally region-specific, so this is a natural-language locale policy issue.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.