Security audit

小红书爆款笔记生成 Agent Skill

Security checks across malware telemetry and agentic risk

Overview

The skill is broadly documented, but its local MCP mode gives an agent all scopes for account login, publishing, enterprise controls, and job replay, so users should review it before installing.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

Code: suspicious.install_untrusted_source
Location: assets/providers.yaml:40

Install source points to URL shortener or raw IP.

Warn

Code: suspicious.install_untrusted_source
Location: src/xhs_skill/resources/assets/providers.yaml:40