Xhs Cover Skill

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:11 AM UTC
• Version: 3.0.0

Overview

The skill appears purpose-aligned, but it repeatedly runs an unpinned npm CLI that can change after review while handling an API key and user-provided content.

Review this before installing. The main issue is not hidden malicious code in the skill package, but that normal use runs the latest `xhscover` package from npm unless you pin or preinstall a trusted version. Only use it if you trust the xhscover npm package and xhscover.cn service with your API key and cover text.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: scripts/xhs-cover.sh:7

Finding

Unpinned Third-Party npm Package Execution

Content

View full analysis

Vulnerability Details

File Location: scripts/xhs-cover.sh:7
Vulnerability Type: Unpinned dependency execution through npx
Risk Level: Medium

Vulnerable Code

bash

exec npx xhscover "$@"

The documentation also instructs users to execute the same unpinned package in SKILL.md:22,30,36,39,42 and README.md:39,62,65,68,71.

Technical Analysis

The wrapper invokes xhscover through npx without specifying an exact package version or enforcing a previously installed, integrity-verified local dependency. If no suitable local executable is available, npx may resolve and download the current package published under that name, then execute its code.

This creates a mutable supply-chain execution path: the code reviewed in this repository does not fully determine the code executed at runtime. A malicious or compromised future package release could therefore execute within the local process context. The repository contains no lockfile or integrity metadata that constrains package resolution.

Argument boundaries are correctly preserved by "$@"; no shell command-injection issue was identified in the wrapper itself.

Attack Path

1. An attacker compromises the xhscover npm package, its publisher account, or its release process.
2. The attacker publishes a malicious package version under the existing package name.
3. A user or Agent invokes scripts/xhs-cover.sh on a system where the package is not pinned and locally installed.
4. npx resolves and obtains the mutable package version from the configured npm registry.
5. npm lifecycle logic or the package executable runs with the privileges of the invoking user.
6. The malicious package can access resources available to that user before optionally continuing the expected cover-generation behavior to reduce detection.

Impact Assessment

Successful exploitation permits arbitrary code execution with the privileges of the user running ...[truncated 504 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin xhscover to an audited exact version rather than resolving the registry's current release.
2. Declare the package in a package.json and commit a lockfile containing registry URL and integrity metadata.
3. Install dependencies during a controlled deployment phase using a lockfile-enforcing command such as npm ci.
4. Invoke only the installed local binary, for example with npx --no-install xhscover "$@" or an explicit path under node_modules/.bin.
5. Disable unnecessary npm lifecycle scripts during installation where compatible with the package.
6. Review dependency updates before changing the pinned version, and use registry provenance, integrity verification, and automated dependency scanning.
7. Run the skill with least privilege and restrict access to unrelated credentials and sensitive files.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (17)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README presents the skill name and core usage description entirely in Chinese, and the example invocations are also written in Chinese. This indicates a language-specific interaction expectation without explicitly offering an alternative language or asking for user opt-in, which fits the language/locale policy concern.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The README instructs users to run npx xhscover setup without pinning a specific package version. npx will fetch the latest published package at execution time, so if the npm package is compromised, typo-squatted, or updated maliciously, users may execute attacker-controlled code on their local machine. In this skill context, that risk is amplified because the command is part of first-run setup and is likely to be copied verbatim by users.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

This usage example tells users to execute npx xhscover generate ... without a pinned version. Because npx resolves and may download the latest package dynamically, a compromised upstream npm release could lead to arbitrary code execution on the user's system when they try to generate an image. The skill is explicitly designed for end-user copy/paste usage, which makes the unsafe install pattern materially risky rather than merely theoretical.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The unpinned npx xhscover balance example causes users to trust and execute whatever version is current on npm at runtime. If the package publisher account, package ownership, or distribution channel were compromised, this simple balance check could become an arbitrary code execution vector. Since the command may access locally stored credentials such as the API key under ~/.xhscover, compromise could also expose secrets.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The npx xhscover history 20 example uses an unpinned remote package execution pattern. That allows silent drift to newly published code and creates a supply-chain attack opportunity where attackers could run arbitrary code or harvest tokens/history data under the guise of a benign history query. The risk is elevated because the documentation normalizes repeated use of this unsafe pattern across multiple commands.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

This section continues recommending npx xhscover usage without version pinning for operational commands. In practice, that means every invocation may execute newly published code, expanding exposure from one-time setup to routine use and increasing the likelihood of eventual supply-chain compromise affecting users. The surrounding context shows the CLI stores credentials and communicates with a remote service, so compromised code could exfiltrate API keys and user content.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The architecture section references npx xhscover (npm 包, Node.js), reinforcing a design pattern of executing an npm package without version pinning. While this instance is descriptive rather than a direct shell command, it still promotes mutable remote execution and may influence users or integrators to adopt an unsafe pattern. The risk is somewhat lower than explicit runnable examples but still real in documentation-driven workflows.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The activation criteria are broad everyday requests such as generating social-media covers or article images, which can cause the skill to trigger in more situations than necessary. Because the skill sends user text and API keys to an external service and may prompt first-time registration, unintended invocation increases the chance of accidental data disclosure and unexpected third-party execution.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The skill depends on invoking npx to fetch and run xhscover without pinning an exact package version. This creates a supply-chain risk: a future compromised or malicious package release could be executed automatically on the user's machine, and this skill also handles API keys, increasing the sensitivity of compromise.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

npx xhscover executes a package resolved from the registry at runtime without an explicit version, which means the executed code may change over time. If the npm package or one of its dependencies is hijacked, the skill could execute attacker-controlled code and expose local environment data or the user's API key.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The setup flow uses unpinned npx xhscover setup, so first-time users may execute whatever version is current in the registry during account registration and API-key configuration. Because this step likely stores credentials or tokens, a compromised package version could steal secrets or alter local configuration.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The generate command uses npx xhscover without version pinning, so image-generation requests may run different code at different times. Since the tool sends user-provided content and API credentials to a remote service, any package compromise could exfiltrate data or execute arbitrary local actions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

This invocation again relies on an unpinned runtime package fetch through npx, exposing users to registry/package takeover risk. The repeated pattern increases likelihood that users will copy unsafe commands directly, normalizing execution of mutable third-party code.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The balance command is lower functional risk than setup or generation, but it still executes unpinned package code from npm. Even read-only style commands can run arbitrary code during startup, so compromise could still lead to credential theft or host compromise.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The data-flow section explicitly states the skill works by calling npx xhscover, again without a fixed version. Because the skill also transmits API keys and prompt content to a remote service, any upstream package compromise has a direct path to sensitive data exfiltration and user deception.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The script executes npx xhscover "$@" without pinning an exact package version. That allows whatever version is currently resolved from the registry to be fetched and executed at runtime, creating a supply-chain risk: a compromised upstream package, typosquat, or malicious new release could run arbitrary code in the user's environment. The skill context increases danger because the script is a thin wrapper that directly executes external code and may auto-handle registration/login, potentially exposing credentials, tokens, or local data if the package is malicious.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.