ClawHub
Back to skill

Security audit

小红书智能回复助手

Security checks for vulnerabilities and agentic risk

Overview

The skill appears aligned with Xiaohongshu comment replies, but it needs review because it handles session/API credentials and uses unsafe dependency installation guidance.

Review this skill before installing. Use offline analysis where possible, avoid providing Xiaohongshu session cookies unless you trust the API integration path, install dependencies in an isolated environment, and prefer pinned, hash-verified dependency files over the documented pip command.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:103
Finding

Unpinned third-party dependency installation in the primary skill documentation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 103-111
Vulnerability Type: Unpinned and integrity-unverified Python dependencies
Risk Level: Medium

Vulnerable Code

bash
## Installation

```bash
# Install dependencies
pip3 install aiohttp loguru pycryptodome getuseragent

# Or use the install script
chmod +x install.sh
./install.sh

Technical Analysis

The installation command resolves mutable package releases from the Python package index configured in the user's environment. It does not specify exact versions, cryptographic hashes, a lockfile, or an explicitly trusted package source.

Consequently, the effective code installed by this command can change independently of the reviewed skill. Relevant supply-chain threats include compromise of a legitimate package release, use of an untrusted package index, dependency confusion, and package substitution. When source distributions are selected, package build backends can execute code during installation. Installed dependencies can also execute code when subsequently imported by the described assistant.

The alternative instructions refer to install.sh, but that file is not included in the audited artifact. Its behavior therefore cannot be reviewed, and the command will fail for the package as provided.

No evidence establishes that any named package is currently malicious. The vulnerability is the absence of dependency pinning, integrity verification, and reproducible dependency metadata.

Attack Path

  1. A user or agent follows the documented installation procedure.
  2. pip3 queries the package indexes configured in the execution environment.
  3. Because no versions or hashes are constrained, pip3 accepts whatever compatible releases the index currently supplies.
  4. An attacker who compromises a selected release or influences package resolution supplies malicious package or build code.
  5. The malicious code runs during ...[truncated 857 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin every direct and transitive dependency to an exact reviewed version.
  2. Generate and ship a lockfile containing cryptographic hashes for all supported platforms.
  3. Install dependencies using hash enforcement, such as pip install --require-hashes -r requirements.txt.
  4. Document the trusted package index and prevent unintended fallback to uncontrolled indexes.
  5. Regularly scan the locked dependency set for known vulnerabilities and review updates before changing pins.
  6. Perform installation inside an isolated virtual environment or container using a non-privileged account.
  7. Include install.sh in the package for review or remove all references to it.
  8. If an installer is added, ensure it uses the same pinned, hash-verified dependency manifest and does not download or execute unreviewed remote content.

T08 · Insecure Dependencies

Warning
Location
clawhub-publish/SKILL.md:103
Finding

Unpinned third-party dependency installation in the published skill copy

Content
View full analysis

Vulnerability Details

File Location: clawhub-publish/SKILL.md, lines 103-111
Vulnerability Type: Unpinned and integrity-unverified Python dependencies
Risk Level: Medium

Vulnerable Code

bash
## Installation

```bash
# Install dependencies
pip3 install aiohttp loguru pycryptodome getuseragent

# Or use the install script
chmod +x install.sh
./install.sh

Technical Analysis

The published copy repeats an installation command that retrieves mutable package versions without exact pins, hashes, a lockfile, or a defined trusted package source. The code ultimately installed can therefore differ from the content that was reviewed.

Package build logic may execute during installation when a source distribution is built, while installed modules can execute code when later imported. This creates a supply-chain execution channel if an attacker compromises a dependency release or controls package resolution through the configured index.

The referenced install.sh file is absent from the audited project. Its contents cannot be assessed, and the documented commands cannot execute that installer as packaged.

No evidence shows that the named dependencies are currently malicious. The confirmed weakness is the unsafe and non-reproducible dependency installation process.

Attack Path

  1. A user obtains the published skill and follows its installation instructions.
  2. pip3 resolves unconstrained dependency versions using the user's configured indexes.
  3. A compromised release, substituted package, or attacker-controlled index response is selected.
  4. Malicious build or package code executes during installation or subsequent import.
  5. The payload inherits the permissions, accessible files, environment, and network connectivity of the invoking process.

Impact Assessment

Exploitation could result in arbitrary code execution under the invoking user's account. Accessible user data, confi ...[truncated 467 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace the unconstrained command with a reviewed requirements or lock file containing exact versions and hashes.
  2. Require hash validation during installation.
  3. Configure and document a trusted package index rather than relying on arbitrary environment configuration.
  4. Review both direct and transitive dependencies before publication and automate vulnerability scanning.
  5. Recommend installation in an isolated, non-privileged environment.
  6. Keep the published copy synchronized with the primary skill documentation.
  7. Include the referenced installer for security review or remove the installer commands.
  8. Ensure any future installer refuses unresolved, unpinned, or hash-mismatched packages.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The trigger list includes "social media management," which is a very broad phrase that could overlap with many unrelated tasks rather than narrowly identifying this Xiaohongshu reply skill. The manifest does not provide exclusion conditions or tighter scope to clarify when this skill should or should not activate.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly supports real API integration, session cookie use, and comment monitoring, but does not clearly warn that user content, note identifiers, tokens, and session data may be transmitted to external services or third-party components. This creates privacy and credential-handling risk because users may enable monitoring or provide cookies without understanding where data goes or how it is protected.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The trigger list includes broad English phrases such as "xiaohongshu reply" and "rednote comments" that could plausibly match loosely related user requests, causing the skill to activate outside its intended scope. Overly broad activation increases the chance of inappropriate routing, unnecessary exposure of the skill’s capabilities, or accidental use in contexts where social-media comment handling was not requested.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.