Security audit

小红书爆款笔记生成 Agent Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill is broadly documented, but its local MCP mode gives an agent all scopes for account login, publishing, enterprise controls, and job replay, so users should review it before installing.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

Code: suspicious.install_untrusted_source
Location: assets/providers.yaml:40

Install source points to URL shortener or raw IP.

Warn

Code: suspicious.install_untrusted_source
Location: src/xhs_skill/resources/assets/providers.yaml:40