OpenClaw Xiaohongshu MCP

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:52 AM UTC
• Version: 1.0.1

Overview

The skill is coherent for Xiaohongshu automation, but it should be reviewed because it can post publicly and relies on a persistent unpinned Docker container with account session data.

Install only if you trust the Docker image publisher and are comfortable granting it persistent access to your Xiaohongshu login/session data. Use private visibility for tests, confirm every comment or post manually, consider pinning the container image to a reviewed digest, and avoid passing untrusted text or identifiers into the shell scripts until JSON serialization is fixed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: assets/docker-compose.xiaohongshu-mcp.yml:3
• Finding: Unpinned Third-Party Container Handles Sensitive Account Data<![CDATA[ ## Vulnerability Details **File Location**: `assets/docker-compose.xiaohongshu-mcp.yml:1-16` **Vulnerability Type**: Unpinned third-party container dependency **Risk Level**: High ### Vulnerable Code ```yaml services: xiaohongshu-mcp: image: xpzouying/xiaohongshu-mcp container_name: xiaohongshu-mcp restart: unless-stopped ports: - "127.0.0.1:18060:18060" environment: TZ: Asia/Shanghai ROD_BROWSER_BIN: /usr/bin/google-chrome volumes: - ./data/xiaohongshu-mcp/cookies.json:/app/cookies.json - ./data/xiaohongshu-mcp/chrome:/root/.config/google-chrome - ./data/xiaohongshu-mcp/pki:/root/.pki - ./data/xiaohongshu-mcp/rod-user-data:/tmp/rod/user-data - ./data/xiaohongshu-mcp/images:/images ``` ### Technical Analysis The Compose configuration references `xpzouying/xiaohongshu-mcp` without an explicit version or immutable image digest. This is effectively a mutable image reference whose contents can change when the image is subsequently pulled or resolved. The container is given access to sensitive persistent data, including: - Xiaohongshu authentication cookies. - The Chrome user profile. - Browser PKI data. - Rod browser automation state. - Files in the mounted image directory. Consequently, trust in the external image publisher and registry directly extends to the user's authenticated Xiaohongshu session and mounted files. If the publisher account, registry, build pipeline, or mutable image tag is compromised, newly downloaded image content could access these resources without any corresponding change to this repository. The service is appropriately bound to `127.0.0.1`, but loopback binding only limits inbound network exposure. It does not protect mounted data from malicious code executing inside the container. ### Attack Path 1. An attacker compromises the image publisher account, registry entry, or upstream image build process. 2. The attacker publishes modified content und ...[truncated 1365 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the image to a reviewed immutable digest: ```yaml image: xpzouying/xiaohongshu-mcp@sha256:<verified-digest> ``` 2. Record the corresponding source version and image provenance in the setup documentation. 3. Verify image signatures or attestations before deployment where supported. 4. Review the upstream source and build process before selecting a digest. 5. Configure a non-root container user if the image supports it: ```yaml user: "<non-root-uid>:<non-root-gid>" ``` 6. Mark mounts as read-only wherever write access is unnecessary. Separate authentication data from general content mounts. 7. Add container hardening controls where compatible: ```yaml read_only: true cap_drop: - ALL security_opt: - no-new-privileges:true ``` 8. Restrict outbound network access to destinations required for legitimate operation. 9. Regularly rotate or invalidate stored sessions after suspected image or supply-chain compromise. 10. Upgrade by explicitly reviewing and replacing the pinned digest rather than automatically following a mutable image reference. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/xhs-comment.sh:19
• Finding: Unescaped Input Is Interpolated into MCP JSON Arguments<![CDATA[ ## Vulnerability Details **File Locations**: - `scripts/xhs-comment.sh:19-32` - `scripts/xhs-detail.sh:21-29` **Vulnerability Type**: Improper JSON construction and insufficient input validation **Risk Level**: Medium ### Vulnerable Code From `scripts/xhs-comment.sh`: ```bash FEED_ID="$1" XSEC_TOKEN="$2" CONTENT="$3" COMMENT_ID="${4:-}" USER_ID="${5:-}" if [ -n "$COMMENT_ID" ] || [ -n "$USER_ID" ]; then if [ -z "$COMMENT_ID" ] || [ -z "$USER_ID" ]; then echo "❌ 回复指定评论时，comment_id 和 user_id 必须同时提供。" exit 1 fi mcporter --config "$CONFIG" call xiaohongshu.reply_comment_in_feed --args "$(printf '{\"feed_id\":\"%s\",\"xsec_token\":\"%s\",\"content\":\"%s\",\"comment_id\":\"%s\",\"user_id\":\"%s\"}' "$FEED_ID" "$XSEC_TOKEN" "$CONTENT" "$COMMENT_ID" "$USER_ID")" else mcporter --config "$CONFIG" call xiaohongshu.post_comment_to_feed --args "$(printf '{\"feed_id\":\"%s\",\"xsec_token\":\"%s\",\"content\":\"%s\"}' "$FEED_ID" "$XSEC_TOKEN" "$CONTENT")" fi ``` From `scripts/xhs-detail.sh`: ```bash FEED_ID="$1" XSEC_TOKEN="$2" LOAD_ALL="${3:-false}" echo "📖 读取小红书笔记详情" echo " feed_id: $FEED_ID" echo " load_all_comments: $LOAD_ALL" mcporter --config "$CONFIG" call xiaohongshu.get_feed_detail --args "$(printf '{\"feed_id\":\"%s\",\"xsec_token\":\"%s\",\"load_all_comments\":%s}' "$FEED_ID" "$XSEC_TOKEN" "$LOAD_ALL")" ``` ### Technical Analysis The scripts construct JSON by inserting shell arguments directly into `printf` format placeholders. Shell quoting prevents these values from becoming shell commands, so this is not shell command injection. It does not, however, perform JSON escaping. Values containing quotation marks, backslashes, newlines, or other JSON control characters can therefore: - Produce invalid JSON and interrupt the requested operation. - Terminate an intended JSON string. - Inject additional JSON properties. - Potentially override or alter interpreted parameters, depending on duplicate-key and schema handling in `mcport ...[truncated 2310 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace manual interpolation with a real JSON serializer. For example, use `jq` for comment creation: ```bash ARGS="$( jq -n \ --arg feed_id "$FEED_ID" \ --arg xsec_token "$XSEC_TOKEN" \ --arg content "$CONTENT" \ '{ feed_id: $feed_id, xsec_token: $xsec_token, content: $content }' )" mcporter --config "$CONFIG" \ call xiaohongshu.post_comment_to_feed \ --args "$ARGS" ``` 2. Serialize reply parameters in the same manner: ```bash ARGS="$( jq -n \ --arg feed_id "$FEED_ID" \ --arg xsec_token "$XSEC_TOKEN" \ --arg content "$CONTENT" \ --arg comment_id "$COMMENT_ID" \ --arg user_id "$USER_ID" \ '{ feed_id: $feed_id, xsec_token: $xsec_token, content: $content, comment_id: $comment_id, user_id: $user_id }' )" ``` 3. Strictly validate `LOAD_ALL` before serialization: ```bash case "$LOAD_ALL" in true|false) ;; *) echo "load_all_comments must be true or false" >&2 exit 1 ;; esac ``` 4. Pass the Boolean safely with `jq`: ```bash ARGS="$( jq -n \ --arg feed_id "$FEED_ID" \ --arg xsec_token "$XSEC_TOKEN" \ --argjson load_all_comments "$LOAD_ALL" \ '{ feed_id: $feed_id, xsec_token: $xsec_token, load_all_comments: $load_all_comments }' )" ``` 5. Apply format and length validation to feed, comment, and user identifiers where their expected syntax is known. 6. Add tests covering quotes, backslashes, newlines, Unicode, empty values, and attempted JSON-property injection. 7. Retain server-side schema validation so unknown properties and duplicate keys are rejected even if a client-side defect is introduced later. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

Ae1

High

• Category: analysis-evasion

Content

./scripts/xhs-detail.sh <feed_id> <xsec_token>

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

./scripts/xhs-detail.sh <feed_id> <xsec_token>

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

./scripts/xhs-comment.sh <feed_id> <xsec_token> "评论内容"

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

./scripts/xhs-comment.sh <feed_id> <xsec_token> "评论内容"

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The README advertises capabilities to post comments, replies, and publish image posts to an external Xiaohongshu account, but it does not warn users that these actions modify third-party platform content and can affect a real account. In an agent skill context, missing explicit safety and consent guidance increases the risk of accidental unauthorized posting, spam, reputational harm, or unintended account actions when the skill is invoked automatically.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill instructs use of local scripts, local config files, Docker compose files, templates, and logs, which implies file read/write capability, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates an unnecessary trust gap: an agent may access or modify local files beyond what a user expects, especially in a skill that interacts with local containers and publishing workflows.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: This shell script performs external service calls that transmit user-provided content and identifiers via `mcporter`, but the only output shown to the user is usage/help text and an installation error. There is no confirmation prompt, no explicit notice before submission, and no inline comment/docstring disclosing that the script will post or reply publicly on Xiaohongshu.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: This shell script sends the user's search keyword to an external service via `mcporter call xiaohongshu.search_feeds`, which is a network/data-transmission operation covered by the warning requirement for code files. Although the script prints usage and selection prompts, it does not disclose that the keyword will be sent to an external service or otherwise warn about the outbound request.

Natural-Language Policy Violations

Low

• Confidence: 86% confidence
• Finding: The manifest hard-codes `TZ: Asia/Shanghai`, which imposes a specific locale/timezone behavior on the skill. This can violate language/locale policy expectations when the skill is not clearly documented as region-specific or offering user opt-in.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: This manifest/template file contains user-facing strings entirely in Chinese, including the title, body, visibility, and tags. Because the file does not offer localization or indicate that it is intended only for a Chinese-language context, it may violate a language/locale policy requiring user choice or documented justification.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: The natural-language template fields are written entirely in Chinese ("这里改标题", "这里改正文内容...") and provide no indication that language is optional or configurable. This can violate a language/locale policy when a skill implicitly constrains output language without user opt-in or a documented region-specific purpose.

Natural-Language Policy Violations

Low

• Confidence: 96% confidence
• Finding: The script's user-facing output strings are entirely in Chinese, including the dependency error, usage text context, and publish status message. For a general-purpose shell skill, this imposes a specific language on users without opt-in or a documented region-specific justification, which matches the language/locale policy concern.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: The script's user-facing messages are hard-coded in Chinese, including the error and usage text. This imposes a specific language on all users without any documented opt-in or locale selection, which matches the natural-language locale policy violation criteria.

Static analysis

No suspicious patterns detected.