小红书爆款笔记生成 Agent Skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:34 AM UTC
• Version: 5.15.0

Overview

The skill’s RED/Xiaohongshu content and publishing purpose is mostly coherent, but verified security weaknesses around network downloads, Vault secrets, and identity-derived file writes require Review before installation.

Install only in an isolated, trusted environment and avoid enabling browser publishing, post-publish sync, or enterprise Vault/OIDC features until the URL-download, HTTPS-only Vault, and tenant-identifier validation issues are fixed. Use trusted image providers, enforce outbound network controls, require HTTPS for secrets infrastructure, and keep account sessions and approval tokens tightly scoped.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: src/xhs_skill/providers/openai_images.py:82

Finding

Provider-Controlled Image URL Enables Server-Side Request Forgery and Unbounded Download

Content

View full analysis

bytes: client = await get_http_pool().get() response = await client.get(url, timeout=120.0) response.raise_for_status() content = response.content if not content: raise RuntimeError("Image URL download returned empty body") return content ``` ### Technical Analysis The image-generation provider can return either base64 image data or a URL. When it returns a URL, the Skill requests that URL without applying `validate_public_url()`, restricting the destination to approved image hosts, or rejecting loopback, link-local, private, and reserved addresses. Although the shared HTTP client disables redirects, this does not prevent direct requests to destinations such as loopback services, private network services, or cloud instance metadata addresses. The response is also read into memory in its entirety through `response.content`. There is no maximum response-size limit, and the received bytes are written with a `.png` extension without validating the response content type or decoding the data as an image. ### Attack Path 1. An attacker controls, compromises, or impersonates a configured OpenAI-compatible image provider. 2. The user invokes cover-image generation. 3. The provider returns an item without `b64_json` but with a URL pointing to an internal service, ...[truncated 965 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: src/xhs_skill/enterprise/secrets.py:79

Finding

Vault Secrets and Authentication Token Can Be Transmitted over Plaintext HTTP

Content

View full analysis

str: parsed = urlparse(url) if parsed.scheme not in {"http", "https"}: raise ValueError("Only http and https URLs are allowed") ``` The Vault address is accepted through that validator: ```python self.base = validate_public_url(self.settings.vault_addr.rstrip("/")) ``` Vault encryption transmits the plaintext secret in reversible base64 encoding along with the Vault authentication token: ```python def encrypt(self, plaintext: bytes, *, context: dict[str, str]) -> SecretEnvelope: payload = { "plaintext": base64.b64encode(plaintext).decode("ascii"), "context": base64.b64encode( json.dumps(context, sort_keys=True, separators=(",", ":")).encode("utf-8") ).decode("ascii"), } response = httpx.post( self._url("encrypt"), json=payload, headers={"X-Vault-Token": str(self.settings.vault_token)}, timeout=10.0, follow_redirects=False, ) response.raise_for_status() ciphertext = str(response.json()["data"]["ciphertext"]) return SecretEnvelope( backend=self.name, ciphertext=ciphertext, key_id=f"vault:{self.settings.vault_transit_mount}/{self.settings.vault_transit_key}", ) ``` The decrypt operation has the same transport weakness and returns base64-encoded plaintext: ```python def decrypt(self, envelope: SecretEnvelope, *, context: dict[str, str]) -> bytes: if envelope.backend != self.name: raise ValueError("Envelope is not compatible with Vault") payload = { "ciphertext": envelope.ciphertext, "context": base64.b64encode( ...[truncated 2223 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: src/xhs_skill/publishing/selector_health.py:99

Finding

Unvalidated OIDC Tenant Claim Can Escape the Selector Snapshot Directory

Content

View full analysis

Path | None: """落盘最近一次 canary 结果，供定时任务/人工对账。""" settings = settings or get_settings() try: root = Path("./data/canary") root.mkdir(parents=True, exist_ok=True) path = root / f"{tenant_id}_{account_id}.json" path.write_text( json.dumps(result, ensure_ascii=False, indent=2), encoding="utf-8", ) return path except OSError: return None ``` ### Technical Analysis Local token verific ...[truncated 2205 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (284)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 160)May include surrounding context.

md

pip install -e '.[dev]'

# 2. Configure
cp .env.example .env
# Edit .env with your API keys

# 3. Browser publishing requires

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README_EN.md (reported line 158)May include surrounding context.

md

pip install -e '.[dev]'

# 2. Configure
cp .env.example .env
# Edit .env with your API keys

# 3. Browser publishing requires

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Bearer-token enforcement, token verification, scope-based authorization, and especially any development/test authentication bypass are highly sensitive security functions. If these capabilities are present in a broadly exposed skill without explicit manifest scoping, an attacker or misconfigured host could gain unintended access paths or rely on weaker auth behavior than operators expect.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Bearer-token enforcement, token verification, scope-based authorization, and especially any development/test authentication bypass are highly sensitive security functions. If these capabilities are present in a broadly exposed skill without explicit manifest scoping, an attacker or misconfigured host could gain unintended access paths or rely on weaker auth behavior than operators expect.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Bearer-token enforcement, token verification, scope-based authorization, and especially any development/test authentication bypass are highly sensitive security functions. If these capabilities are present in a broadly exposed skill without explicit manifest scoping, an attacker or misconfigured host could gain unintended access paths or rely on weaker auth behavior than operators expect.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Bearer-token enforcement, token verification, scope-based authorization, and especially any development/test authentication bypass are highly sensitive security functions. If these capabilities are present in a broadly exposed skill without explicit manifest scoping, an attacker or misconfigured host could gain unintended access paths or rely on weaker auth behavior than operators expect.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Bearer-token enforcement, token verification, scope-based authorization, and especially any development/test authentication bypass are highly sensitive security functions. If these capabilities are present in a broadly exposed skill without explicit manifest scoping, an attacker or misconfigured host could gain unintended access paths or rely on weaker auth behavior than operators expect.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

Bearer-token enforcement, token verification, scope-based authorization, and especially any development/test authentication bypass are highly sensitive security functions. If these capabilities are present in a broadly exposed skill without explicit manifest scoping, an attacker or misconfigured host could gain unintended access paths or rely on weaker auth behavior than operators expect.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Bearer-token enforcement, token verification, scope-based authorization, and especially any development/test authentication bypass are highly sensitive security functions. If these capabilities are present in a broadly exposed skill without explicit manifest scoping, an attacker or misconfigured host could gain unintended access paths or rely on weaker auth behavior than operators expect.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

Bearer-token enforcement, token verification, scope-based authorization, and especially any development/test authentication bypass are highly sensitive security functions. If these capabilities are present in a broadly exposed skill without explicit manifest scoping, an attacker or misconfigured host could gain unintended access paths or rely on weaker auth behavior than operators expect.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

Bearer-token enforcement, token verification, scope-based authorization, and especially any development/test authentication bypass are highly sensitive security functions. If these capabilities are present in a broadly exposed skill without explicit manifest scoping, an attacker or misconfigured host could gain unintended access paths or rely on weaker auth behavior than operators expect.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Bearer-token enforcement, token verification, scope-based authorization, and especially any development/test authentication bypass are highly sensitive security functions. If these capabilities are present in a broadly exposed skill without explicit manifest scoping, an attacker or misconfigured host could gain unintended access paths or rely on weaker auth behavior than operators expect.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Bearer-token enforcement, token verification, scope-based authorization, and especially any development/test authentication bypass are highly sensitive security functions. If these capabilities are present in a broadly exposed skill without explicit manifest scoping, an attacker or misconfigured host could gain unintended access paths or rely on weaker auth behavior than operators expect.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Bearer-token enforcement, token verification, scope-based authorization, and especially any development/test authentication bypass are highly sensitive security functions. If these capabilities are present in a broadly exposed skill without explicit manifest scoping, an attacker or misconfigured host could gain unintended access paths or rely on weaker auth behavior than operators expect.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Bearer-token enforcement, token verification, scope-based authorization, and especially any development/test authentication bypass are highly sensitive security functions. If these capabilities are present in a broadly exposed skill without explicit manifest scoping, an attacker or misconfigured host could gain unintended access paths or rely on weaker auth behavior than operators expect.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Bearer-token enforcement, token verification, scope-based authorization, and especially any development/test authentication bypass are highly sensitive security functions. If these capabilities are present in a broadly exposed skill without explicit manifest scoping, an attacker or misconfigured host could gain unintended access paths or rely on weaker auth behavior than operators expect.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

Bearer-token enforcement, token verification, scope-based authorization, and especially any development/test authentication bypass are highly sensitive security functions. If these capabilities are present in a broadly exposed skill without explicit manifest scoping, an attacker or misconfigured host could gain unintended access paths or rely on weaker auth behavior than operators expect.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Bearer-token enforcement, token verification, scope-based authorization, and especially any development/test authentication bypass are highly sensitive security functions. If these capabilities are present in a broadly exposed skill without explicit manifest scoping, an attacker or misconfigured host could gain unintended access paths or rely on weaker auth behavior than operators expect.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Bearer-token enforcement, token verification, scope-based authorization, and especially any development/test authentication bypass are highly sensitive security functions. If these capabilities are present in a broadly exposed skill without explicit manifest scoping, an attacker or misconfigured host could gain unintended access paths or rely on weaker auth behavior than operators expect.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Bearer-token enforcement, token verification, scope-based authorization, and especially any development/test authentication bypass are highly sensitive security functions. If these capabilities are present in a broadly exposed skill without explicit manifest scoping, an attacker or misconfigured host could gain unintended access paths or rely on weaker auth behavior than operators expect.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Bearer-token enforcement, token verification, scope-based authorization, and especially any development/test authentication bypass are highly sensitive security functions. If these capabilities are present in a broadly exposed skill without explicit manifest scoping, an attacker or misconfigured host could gain unintended access paths or rely on weaker auth behavior than operators expect.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

Bearer-token enforcement, token verification, scope-based authorization, and especially any development/test authentication bypass are highly sensitive security functions. If these capabilities are present in a broadly exposed skill without explicit manifest scoping, an attacker or misconfigured host could gain unintended access paths or rely on weaker auth behavior than operators expect.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

Bearer-token enforcement, token verification, scope-based authorization, and especially any development/test authentication bypass are highly sensitive security functions. If these capabilities are present in a broadly exposed skill without explicit manifest scoping, an attacker or misconfigured host could gain unintended access paths or rely on weaker auth behavior than operators expect.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

Bearer-token enforcement, token verification, scope-based authorization, and especially any development/test authentication bypass are highly sensitive security functions. If these capabilities are present in a broadly exposed skill without explicit manifest scoping, an attacker or misconfigured host could gain unintended access paths or rely on weaker auth behavior than operators expect.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Bearer-token enforcement, token verification, scope-based authorization, and especially any development/test authentication bypass are highly sensitive security functions. If these capabilities are present in a broadly exposed skill without explicit manifest scoping, an attacker or misconfigured host could gain unintended access paths or rely on weaker auth behavior than operators expect.

Content

No source excerpt is available for this finding.