rednote summarize

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:57 PM UTC
• Version: 1.0.0

Overview

This skill mostly does what it says, but it tells the agent it may ask users for session cookies, which is sensitive account access without safeguards.

Review this skill carefully before installing. It is reasonable for it to open a Xiaohongshu link and ask you to complete QR login in the browser, but you should not provide cookies, session tokens, passwords, one-time codes, or other account credentials through chat or prompts.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:8

Finding

Unsafe Solicitation of Authentication Cookies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 8-10
Vulnerability Type: Solicitation and unsafe handling of reusable session credentials
Risk Level: Medium

Vulnerable Code Snippet

The vulnerable instruction, rendered in English to comply with the report language requirement, is:

markdown

In the `browser_subagent` task instructions, explicitly require it to:
1. After the page loads, if a login dialog appears (usually a QR code), pause or prompt the user to scan the code. If supported, the agent may wait for the user to complete the scan.
2. If login cannot be completed automatically, use `notify_user` to clearly tell the user that manual intervention or the provision of Cookies or other assistance is required.

Technical Analysis

The instruction explicitly permits the agent to ask the user to provide authentication cookies when automatic login is unavailable. Session cookies are sensitive bearer credentials: possession may be sufficient to impersonate the authenticated user without knowing the account password or completing an additional login challenge.

This exceeds the minimum access needed for the declared task. The post can instead be accessed through an official interactive login flow in which the user scans a QR code directly on the service page. The Skill provides no controls for secret entry, domain scoping, transmission security, log redaction, retention, deletion, expiration, or prevention of cookie reuse.

The issue is an insecure Skill configuration rather than evidence of intentional credential theft. No instruction to exfiltrate or misuse the cookies was identified, but soliciting reusable credentials creates an avoidable exposure path.

Attack Path

1. The agent opens a user-supplied Xiaohongshu post URL.
2. The website displays a login barrier.
3. Automatic authentication is unavailable.
4. Following the Skill instructions, the agent uses notify_user to request manual assistance, potentially includi ...[truncated 1015 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove every instruction that asks users to provide cookies, session tokens, authorization headers, or similar reusable credentials.
2. Require authentication exclusively through the official Xiaohongshu page, preferably by having the user complete QR-code authentication directly in the interactive browser session.
3. If authentication cannot be completed safely, stop processing and explain that the content cannot be accessed rather than requesting credentials.
4. Prevent authentication values from being included in prompts, notifications, conversation history, telemetry, screenshots, or tool logs.
5. If a platform-approved session-transfer mechanism is genuinely necessary, use a dedicated secret-input channel with:
   • strict destination-domain scoping;
   • ephemeral in-memory handling;
   • automatic log and output redaction;
   • minimum required cookie selection;
   • no persistence across runs;
   • immediate deletion after use; and
   • clear user consent and revocation guidance.
6. Add explicit instructions that the agent must never request passwords, cookies, one-time codes, recovery codes, or other account credentials.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The instructions explicitly require the assistant to write both the main-post summary and the comment summary in Chinese. This is a natural-language policy concern because it forces a specific language/locale without offering user opt-in or explaining a region-specific requirement.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.