Post To Xhs

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:14 PM UTC
• Version:
  0.1.1

Overview

This skill is a straightforward Xiaohongshu posting helper that requires user confirmation before publishing, though users should review posts carefully because publishing affects their account.

Install only if you trust the Xiaohongshu/MCP publishing integration configured in your agent. Before confirming any post, check the logged-in account, title, body, tags, visibility, schedule time, and every image or video path because the action can publish or schedule content under your account.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger description is overly broad and includes generic phrases such as '帮我发一下', causing the skill to activate in ambiguous contexts where the user may not actually intend to post to Xiaohongshu. Because this skill performs high-impact external actions (content publishing), unintended activation could lead to accidental posting, privacy exposure, or user confusion even though the workflow includes a confirmation step.

VirusTotal

66/66 vendors flagged this skill as clean.