Security audit

跨平台内容自动发布

Security checks for vulnerabilities and agentic risk

Overview

This skill automates social-media account activity and stores login sessions, but its reposting/deduplication workflow and weak session-file safeguards need careful review before installation.

Install only if you are comfortable giving the skill browser-session access to real social-media accounts. Use test accounts first, keep saved auth files out of repositories and backups, restrict file permissions, avoid the video repost/deduplication workflow unless you own or have licensed the media, and review all generated uploads manually before publishing.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: src/platforms/xiaohongshu-publisher.js:64
Finding: Path Traversal in Authentication-State File Destination
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: package.json:10
Finding: Open-Ended Peer Dependency Versions Increase Supply-Chain Exposure
Content: View full analysis
=1.0.0", "xiaohongshu-content-automation": ">=1.0.0", "remotion-video-toolkit": ">=1.0.0" } ``` ### Technical Analysis Each peer dependency uses an open-ended `>=1.0.0` range. This permits any current or future release with a version equal to or greater than `1.0.0`, including unreviewed major versions with incompatible or malicious changes. In npm environments that automatically resolve peer dependencies, installation may retrieve versions that were never tested or reviewed by the project author. Even where peers are installed manually, the declared range communicates that all future versions are acceptable. No lockfile is present in the audited directory to provide a reproducible reviewed dependency graph. This finding does not establish that the named packages or their current releases are malicious. It identifies an avoidable supply-chain weakness that would amplify the effect of a future package compromise or malicious release. ### Attack Path 1. A dependency publisher account or package distribution channel is compromised, or a malicious future version is published. 2. The malicious release retains a version satisfying `>=1.0.0`. 3. A user follows the documented installation process in an environment that installs or resolves the peer dependency. 4. The package manager selects the compromised release because the project imposes no upper bound or reviewed exact version. 5. Malicious lifecycle or runtime code executes with the permissions of the installing or running user. Exploitation depends on a malicious or compromised dependency release being selected during installation or execution. ### Impact Assessment If a selected dependency release is malicious, its JavaScript or installation scripts c ...[truncated 611 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (27)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: 声明描述的是一个功能较完整的跨平台内容自动化系统，而当前代码片段只覆盖 TikTok 上传流程中的一小部分。它确实与“发布到 TikTok”这一子能力相关，但没有实现描述中大部分核心能力，如 AI 内容生成、视频制作、多平台发布、搬运去重等。此外，该实现并未完成最终自动发布，只是填写内容后提示用户手动确认发布，因此与“自动化发布工作流”的表述也存在明显差距。代码没有表现出额外未声明的敏感能力；问题主要在于声明范围远大于实际行为。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description promises a broad cross-platform automation workflow including AI content generation, video production, automatic posting to multiple platforms, and reposting to TikTok/YouTube. The supplied code chunk is much narrower: it is a single-platform Xiaohongshu browser automation module for drafting an image post, handling login state, and filling in content. It does not generate content, process or deduplicate videos, or interact with other listed platforms. Additionally, despite the description claiming automatic publishing, this implementation stops before clicking the publish button and explicitly asks the user to manually verify and publish. This is a material mismatch in scope and capability, not merely an incomplete implementation detail.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: 该描述强调“跨平台内容自动化发布”以及“小红书、抖音、TikTok/YouTube”等多平台能力，还特别提到“国内视频搬运去重后发布”。但提供的代码块仅针对“小红书口播视频工作流”，其 publish() 也只引用 xiaohongshu 账号配置，没有任何抖音、TikTok、YouTube、搬运或去重逻辑。虽然文案生成、TTS、配图、视频合成、自动发布与描述中的一部分方向一致，但整体主能力范围明显比声明更窄。此外，代码实际会读取本地 accounts.json 并写入 video-publish-log.jsonl，这属于未在描述中明确提及的资源访问。综合来看，声明与实际行为存在明显不一致。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The file header and workflow description explicitly describe downloading popular videos from domestic platforms, modifying them to evade duplication detection, and reposting them to TikTok/YouTube. That is not a neutral content-processing feature; it is direct facilitation of deceptive cross-posting and likely copyright/policy evasion at scale.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README presents fully automated cross-platform publishing and reposting workflows without a prominent warning that the skill can perform actions on real third-party accounts and permanently change external content state. This increases the chance of accidental posting, account sanctions, copyright violations, or misuse, especially because the skill explicitly targets multiple platforms and includes content migration/reposting scenarios.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: The README instructs users to run npx playwright without pinning a specific version, which can pull whatever package version is current at execution time. This creates a supply-chain risk: a compromised upstream release or unexpected breaking change could execute unreviewed code on the user's machine during setup.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The README describes scanning a login and automatically saving cookies, but it does not clearly warn that these cookies are sensitive authentication artifacts that may grant full account access if copied or leaked. In a tool that automates posting to external platforms, stored session cookies materially increase the risk of account takeover, unauthorized publishing, and abuse across linked accounts.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill describes automated publishing and browser-driven login/posting flows without warning users about the risks of automated account actions, including policy violations, accidental posting, account bans, and unintended actions performed under saved sessions. In a workflow that logs in and publishes content to real platforms, omission of these warnings materially increases the chance of harmful misuse or operator error.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill promotes account isolation and saved login state but does not warn users that local cookie/session artifacts will be stored on disk. Storing browser authentication material without clear warnings and handling guidance increases the risk of credential theft, account takeover, or accidental leakage through backups, source control, or shared systems. This is more dangerous here because the skill is specifically designed to automate actions across multiple social-media accounts.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: The skill instructs users to run npx playwright install chromium without pinning a specific Playwright version. Using unpinned tooling can fetch whatever version is current at execution time, which harms reproducibility and increases supply-chain risk if a bad or incompatible release is published. In this skill’s context, the command is part of browser automation that handles account sessions, so unexpected dependency changes can directly affect sensitive account operations.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: L138-L140 states v1.0.0 only has a complete Xiaohongshu text/image workflow and that video reposting and multi-platform support are merely reserved interfaces. This conflicts with earlier manifest/documentation lines such as L004, L031-L034, L058-L065, and L114-L124 that present TikTok/YouTube reposting and cross-platform publishing as current capabilities.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The addAccount flow initializes a publisher, performs login, and saves cookies to a provided path, which involves handling authentication state and writing sensitive session data. Although comments describe the function's purpose, there is no explicit warning, confirmation, or disclosure about storing login cookies or the sensitivity of the resulting file.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The package description is written entirely in Chinese and describes the skill in a way that assumes that language context, with no indication that users can opt into another language or locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The code navigates to https://www.tiktok.com/upload?lang=en, which hard-codes the interface language to English. This is a natural-language/locale policy issue because the skill does not offer a user opt-in or configuration choice, and no justification for enforcing English is documented.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The module comment says this is a '小红书自动发布实现', implying automatic posting. However, the implementation intentionally stops short of submission, logs that the user should manually inspect and publish, and comments out the publishing actions, which directly contradicts the stated intent in the documentation.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest describes a cross-platform automated publishing workflow, but this implementation only fills in the Xiaohongshu post form and explicitly returns a message telling the user to manually review and publish. The actual publish click and success handling are commented out, so the code does not perform the claimed end-to-end automatic publication for this platform.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code includes natural-language comments and console messages exclusively in Chinese, such as the file header and later status prompts. The policy allows locale constraints only when users are given a choice or the restriction is clearly justified, which is not present here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The login flow prints operational instructions only in Chinese, including prompts to complete Google login and confirmation that authentication was saved. This creates a language-policy issue because users are required to understand a specific language without being offered an alternative or explicit notice.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest describes a cross-platform automated publishing workflow, implying end-to-end posting. In this implementation, publishVideo uploads the file and fills metadata, then explicitly instructs the user to review settings and click publish manually, so the actual behavior is only semi-automated rather than automatic publishing.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The workflow automatically publishes content to external platforms without any approval gate, policy validation, or confirmation step. In this skill’s context, the automation is specifically tied to cross-platform reposting of downloaded third-party videos after 'deduplication,' which materially increases the risk of large-scale deceptive posting, copyright abuse, and account misuse.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill's natural-language interface, comments, parameter descriptions, logs, and error messages are all written exclusively in Chinese, and the workflow is tailored to Chinese-language Xiaohongshu posting without any opt-in or language selection. Under the policy, forcing a specific language or locale without user choice is a natural-language policy violation unless the constraint is explicitly documented and justified.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This code appends publication metadata including topic, title, cover image path, and post URL to a local JSONL file. While the operation is commented as '保存发布记录', there is no user-facing notice, confirmation, or explicit disclosure that a persistent activity log will be created on disk.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest describes a broader capability set including cross-platform publishing to Xiaohongshu, Douyin, TikTok, and YouTube, plus domestic-video reposting/deduplication. This file's code and documentation are narrowly scoped to generating a Xiaohongshu oral-broadcast video and publishing only to Xiaohongshu, with no code for the other claimed platforms or reposting workflow.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The top-level comment claims the workflow generates copy, performs TTS, generates images, composes video, and auto-publishes. However, methods such as generateContent, textToSpeech, generateImages, composeVideo, and publish only return empty structures or fabricated output paths without actually carrying out those actions, so the documentation overstates what the code does.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The workflow proceeds directly to publishing generated content without any visible approval gate, preview step, or explicit operator confirmation. In an automation skill that creates and posts media, this increases the risk of unintended publication, account misuse, policy violations, or mass posting of incorrect or harmful content if upstream inputs are wrong or manipulated.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/workflows/video-cross-post.js:111