Temp Xhs Skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:57 AM UTC
• Version: 1.0.0

Overview

This Xiaohongshu publishing skill is mostly coherent, but it asks for persistent auto-reply authority and stores account content in hard-coded local memory files.

Review this carefully before installing. Use it only with a dedicated Xiaohongshu account/profile, disable or remove the Cron auto-reply workflow unless you explicitly want unattended public replies, and move any draft, queue, or comment records into a user-approved skill-specific storage location with clear retention and deletion rules.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T06 · System Persistence

Error

• Location: SKILL.md:630

Finding

Persistent Autonomous Comment-Reply Task Through Cron

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 630-680
Vulnerability Type: Persistent scheduled automation
Risk Level: High

Vulnerable Skill Instructions

text

Trigger conditions:
- Automatically execute through a Cron Job every 30 minutes
- Or trigger manually

Automation implementation:

Cron Job configuration:
- Frequency: Every 30 minutes
- Execution window: All day, with 08:00-23:00 recommended
- Task: Check and reply to new comments

Local record file:
- Location: E:\OpenClaw\agents\ceo\memory\xhs-comments-replied.md

The excerpt above is an English rendering of the relevant instructions at the specified source lines.

Technical Analysis

The Skill explicitly directs the Agent to configure a recurring Cron Job that checks Xiaohongshu comments and posts replies every 30 minutes. This scheduled task can continue after the interaction that initially loaded the Skill has ended.

Because the workflow reuses an authenticated browser profile, each scheduled execution may perform account-level actions without requiring the user to approve each individual reply. The local record file prevents duplicate responses but does not provide authorization controls, an expiration time, a reply approval stage, or a reliable task-removal procedure.

This constitutes system persistence because the recurring task survives the original Skill run and repeatedly invokes authenticated behavior across sessions.

Attack Path

1. A user invokes the Skill while an authenticated Xiaohongshu browser profile is available.
2. The Agent follows the Skill instructions and registers a Cron Job.
3. The scheduled job runs every 30 minutes independently of the initiating conversation.
4. Each run opens the Xiaohongshu notification page and identifies unreplied comments.
5. The automation generates and submits replies using the authenticated account.
6. The process continues until the user or adminis ...[truncated 831 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the instruction to create a persistent Cron Job.
2. Require explicit user initiation for each comment-checking session.
3. Present every proposed reply to the user and require confirmation before submission.
4. If scheduling is an essential feature, require the user to create and enable the schedule through a clearly identified interface.
5. Apply a mandatory expiration time, a maximum execution count, and a documented removal procedure.
6. Use least-privilege credentials and a dedicated browser profile with access limited to the required account functions.
7. Add rate limits, an emergency stop control, audit logging, and notification of every automated execution.
8. Do not retain or reuse an authenticated session after the user revokes authorization.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:286

Finding

Cross-Agent Persistent-State Access Through Hard-Coded Memory Paths

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 286, 584, and 680
Vulnerability Type: Cross-agent access-control boundary violation and unsafe hard-coded storage
Risk Level: Medium

Vulnerable Skill Instructions

text

Local draft backup:
- Backup file location: E:\OpenClaw\agents\ceo\memory\xhs-drafts.md

Scheduled publication queue:
- Queue file location: E:\OpenClaw\agents\marketing\memory\xhs-schedule-queue.md

Replied-comment record:
- Location: E:\OpenClaw\agents\ceo\memory\xhs-comments-replied.md

The excerpt above is an English rendering of the relevant instructions at the specified source lines.

Technical Analysis

The xhs-publisher Skill directs the Agent to access persistent files inside the memory directories of separate ceo and marketing Agents. These paths are hard-coded rather than being resolved from a Skill-scoped, user-approved data directory.

This design violates least-privilege and state-isolation principles. If the executing Agent has filesystem access to these paths, the Skill can create, read, overwrite, or append data within another Agent's persistent memory namespace. The scheduled-publication queue is particularly sensitive because modifying its contents may influence later publishing workflows. Drafts and comment records may also contain private user content, account activity, or operational state.

The issue does not independently bypass operating-system access controls. Exploitation depends on the executing process already having filesystem permission to the referenced directories. Within an environment where Agent memory directories are broadly writable, however, the hard-coded paths enable cross-agent state modification.

Attack Path

1. A user invokes a draft, scheduling, or automated comment-management workflow.
2. The Skill directs the Agent to open a hard-coded path belonging to the ceo or marketing Agent.
3. The executing process uses ...[truncated 1172 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace all hard-coded Agent memory paths with a dedicated, Skill-scoped storage directory.
2. Resolve storage through an approved configuration API rather than embedding absolute filesystem paths.
3. Enforce path allowlisting and reject paths that escape the Skill's assigned data directory.
4. Apply filesystem permissions that prevent one Agent from reading or modifying another Agent's memory.
5. Require explicit user approval before creating or changing persistent draft, queue, or comment-tracking files.
6. Validate queue records against a strict schema and treat all persisted records as untrusted input.
7. Use atomic writes, restrictive file permissions, integrity checks, and audit logs for persistent state.
8. Migrate existing data from the ceo and marketing memory trees into an isolated xhs-publisher directory, then remove obsolete cross-agent files.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The top-level trigger description is broad enough that ordinary requests about publishing, replying, or viewing data could activate the skill without clear user intent for browser automation and account actions. In an account-management skill, overbroad triggering increases the chance of unintended navigation, content handling, or posting actions on a logged-in account.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill says to use it whenever publishing or managing notes is needed, but does not define activation boundaries or prohibited contexts. Because the skill operates on a logged-in social account, missing trigger constraints can lead to accidental invocation and unintended state-changing operations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill includes local backup of drafts but does not prominently warn that note content will be written to a local file. Users may reasonably expect platform-only handling, so undisclosed persistence can expose personal, business, or unpublished content beyond the intended workflow.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Persistent local logging of draft content creates a secondary data store for user notes outside Xiaohongshu, increasing the risk of leakage, over-retention, and unauthorized access from the host system. Because drafts may contain unpublished or sensitive material, the skill context makes this materially more dangerous than ordinary non-sensitive app logs.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

L380-L392 规定回复需“幽默风趣，多用emoji”“整体风格：幽默、热情、有个性”等固定语言风格，但未说明这是可选偏好，也未给用户提供语言/语气选择。根据政策，未经用户选择即强制特定语言/表达方式属于自然语言层面的策略约束问题。

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The local scheduled-post queue encourages persistent storage of posting materials and timing information, creating an unnecessary repository of potentially sensitive campaign content. If the host is shared or compromised, an attacker could inspect upcoming posts, alter plans, or extract unpublished materials.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill expands from interactive publishing into unattended Cron-based comment checking and auto-reply, which changes the trust boundary and enables autonomous account actions without per-action user review. In a social-media account context, this can cause policy violations, unintended replies, spam-like behavior, and reputational damage if the automation misfires or handles adversarial comments poorly.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

L639-L646 的回复原则延续了固定化回复约束，但未提供针对不同受众或用户偏好的语言/风格选项。此类自然语言策略若被硬编码为默认行为，可能与要求提供语言或表达方式选择的政策相冲突。

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Recording commenter identifiers in a persistent local file retains user interaction data beyond the platform's normal interface, creating privacy, compliance, and profiling concerns. In combination with automated reply behavior, this also supports repeated unattended processing of user data without clear user awareness or controls.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The documentation instructs storing draft content in a local filesystem file outside the platform workflow, creating unnecessary persistence of potentially sensitive user-provided text. This broadens data exposure to other local processes, future runs, or unauthorized users who can access the host environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The scheduled-post queue file persists posting plans locally without clearly warning the user that publication timing and content metadata may be retained on disk. While lower severity than full content storage, it still creates unnecessary local exposure of operational and potentially sensitive campaign information.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The auto-reply workflow tells the agent to persist comment IDs or user nicknames locally but does not warn about retention of user interaction identifiers. Even limited identifiers are personal or account-linked data, and silent persistence increases privacy and compliance risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.