小红书

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:03 AM UTC
• Version: 1.0.10

Overview

The skill mostly matches its Xiaohongshu automation purpose, but an under-documented remote endpoint override can send tokens, searches, and draft posts away from the local machine.

Review this skill carefully before installing. Use it only with a dedicated Xiaohongshu account, keep the MCP server bound to localhost, do not set XHS_ALLOW_REMOTE=yes unless you fully trust the endpoint and transport, and pin/review the third-party MCP component and Python dependencies.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/xhs_client.py:42

Finding

Remote Endpoint Override Can Expose Sensitive Request Data

Content

View full analysis

Vulnerability Details

File Location: scripts/xhs_client.py:42-56, scripts/xhs_client.py:91-100, and scripts/xhs_client.py:153-159
Vulnerability Type: Arbitrary remote endpoint override and potential plaintext transmission of sensitive data
Risk Level: Medium

Vulnerable Code

python

def _resolve_base_url():
    url = os.environ.get("XHS_MCP_BASE_URL", _DEFAULT_BASE_URL).rstrip("/")
    try:
        host = urlparse(url).hostname or ""
    except ValueError:
        print(f"❌ Invalid XHS_MCP_BASE_URL: {url!r}", file=sys.stderr)
        sys.exit(1)
    if host not in _LOOPBACK_HOSTS and os.environ.get("XHS_ALLOW_REMOTE") != "yes":
        print(
            f"❌ Refusing non-loopback endpoint: {url}. Set XHS_ALLOW_REMOTE=yes "
            "to override at your own risk.",
            file=sys.stderr,
        )
        sys.exit(1)
    return url

python

def _request(method, path, **kwargs):
    """Unified request handler with consistent error handling.

    Returns parsed JSON on success, or an error dict on failure.
    Never exits the process — callers decide how to handle errors.
    """
    kwargs.setdefault("timeout", DEFAULT_TIMEOUT)
    url = f"{BASE_URL}{path}"
    try:
        resp = requests.request(method, url, **kwargs)

python

payload = {
    "feed_id": feed_id,
    "xsec_token": xsec_token,
    "load_all_comments": load_comments
}
data = _request("POST", "/api/v1/feeds/detail", json=payload)

Technical Analysis

The client defaults to a loopback MCP endpoint, but the XHS_ALLOW_REMOTE=yes environment variable completely bypasses the loopback restriction. XHS_MCP_BASE_URL may then identify an arbitrary remote server, including an unencrypted http:// endpoint.

Requests sent through this configurable endpoint can contain:

• Xiaohongshu xsec_token values and feed identifiers.
• Search terms and filtering prefere ...[truncated 1907 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove XHS_ALLOW_REMOTE and enforce a loopback-only endpoint if remote operation is not part of the declared functionality.
2. Resolve the configured hostname and verify that every resulting address is loopback, rather than relying only on the literal hostname.
3. Restrict accepted schemes to http for verified loopback endpoints, or require https for any explicitly supported remote connection.
4. If remote operation is genuinely required:
   • Document it as a separate high-risk mode.
   • Use a strict endpoint allowlist.
   • Require HTTPS with certificate validation.
   • Prefer mutual TLS or another authenticated channel.
   • Require a dedicated command-line confirmation rather than a reusable environment-variable bypass.
5. Disable redirects or validate every redirect destination to prevent a trusted endpoint from redirecting sensitive requests off-host.
6. Update SKILL.md so its security guarantees accurately reflect runtime behavior.
7. Avoid logging or reflecting complete remote response bodies where they may contain sensitive information.

T08 · Insecure Dependencies

Note

• Location: SETUP.md:21

Finding

Python Dependency Is Installed Without Version or Integrity Pinning

Content

View full analysis

Vulnerability Details

File Location: SETUP.md:21-25
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Low

Vulnerable Code

bash

pip install requests

Technical Analysis

The setup instructions install requests without a fixed version, lock file, or cryptographic hash. Installation therefore depends on the package version currently selected by the operator's configured Python package index.

Although requests is a legitimate dependency and no malicious package is named in the project, the installation is not reproducible. A compromised package index, malicious mirror, dependency substitution, or future incompatible release could introduce unexpected code into the Skill's execution environment.

The client imports requests at startup, so code supplied through the installed package executes within the permissions of the user running the Skill.

Attack Path

1. The operator's configured Python index or mirror is compromised, malicious, or incorrectly configured.
2. The operator follows the documented pip install requests command.
3. Pip retrieves an unverified release or substituted artifact.
4. The package is installed into the selected Python environment.
5. The Skill imports requests, allowing code from the installed package to execute with the current user's privileges.

This path depends on compromise or manipulation of the dependency source; the audited repository does not itself host or automatically retrieve a malicious payload.

Impact Assessment

A malicious dependency could execute arbitrary Python code with the permissions of the user running the installation or client. Depending on those permissions, this could expose local files, environment variables, account-related data, or network access.

Under normal installation from the legitimate Python Package Index, the more likely impact is non-reproducible builds or compatibility failures ...[truncated 24 chars]

Remediation

View remediation

Remediation Suggestions

1. Add a reviewed dependency file containing an exact requests version.

2. Include hashes for the package and its transitive dependencies.

3. Install using hash enforcement, for example:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

4. Generate and review a lock file using a suitable dependency-management tool.

5. Document the expected package index and recommend trusted-index configuration.

6. Periodically update pinned versions after reviewing security advisories and testing compatibility.

7. Prefer an isolated virtual environment so dependency installation does not alter unrelated system or user Python environments.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description is about end-user Xiaohongshu functionality on the social platform itself. In contrast, the supplied code does not interact with Xiaohongshu at all. It is an internal release-management script for distributing the repository as a ClawHub skill package. This is a materially different primary purpose and an undeclared capability involving external package publication and version management. The script’s own comments explicitly state it has nothing to do with publishing notes on Xiaohongshu and is unrelated to the documented end-user workflow. Therefore this code chunk does not accurately represent the declared skill behavior.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill invokes a Python HTTP client against a local service and relies on environment variables for safety gates, but the manifest shown in SKILL.md does not declare any explicit tool scope or permission boundaries. In a skill ecosystem, undeclared network and env capabilities reduce reviewability and can cause the agent to use broader powers than users or platform policy expect.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The activation text says to use the skill whenever a user mentions xiaohongshu/小红书/RedNote or needs research/posting on the platform, which is broad enough to trigger the skill in many contexts without a clear user request for automation. Over-broad routing increases the chance of unnecessary access to local services, unintended data retrieval, or accidental progression toward publishing workflows.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.