Xhs Cover Skill

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:56 AM UTC
• Version: 3.0.0

Overview

The skill is purpose-aligned, but it runs an unpinned npm CLI that handles credentials and user content, so users should review it carefully before installing.

Install only if you trust xhscover.cn and the npm package publisher. Prefer a pinned, reviewed `xhscover` version or a lockfile-managed install before entering an API key or sending private cover text, and avoid using the skill for generic image requests unless you intend to use this specific service.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: scripts/xhs-cover.sh:1

Finding

Unpinned npm Package Is Downloaded and Executed Through npx

Content

View full analysis

Vulnerability Details

File Location: scripts/xhs-cover.sh:1-7
Additional References: SKILL.md:23,29,32,35,38; README.md:41,57,60,63,66
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable code:

bash

#!/bin/bash
# xhs-cover.sh - Xiaohongshu cover generation Skill script
# Invokes xhscover through npx and handles registration/login/generation

set -e

exec npx xhscover "$@"

The documentation similarly instructs users to execute unpinned commands such as:

bash

npx xhscover setup
npx xhscover generate "5 habits that make you more disciplined"
npx xhscover balance
npx xhscover history

Technical Analysis

The wrapper executes xhscover through npx without specifying an exact package version, using a lockfile, validating an integrity hash, or requiring a previously installed local binary. If the package is not available locally, npx can download the package version currently resolved by the npm registry and execute its code.

This creates a supply-chain trust boundary: the code reviewed in this repository does not fully determine the code that runs when the Skill is invoked. A compromised npm publisher account, malicious package release, registry compromise, or unexpected upstream change could cause arbitrary JavaScript or package lifecycle code to execute under the Agent user's account.

Argument forwarding does not independently introduce shell command injection because "$@" preserves argument boundaries and prevents shell reinterpretation. The confirmed issue is the mutable, unpinned executable dependency.

Attack Path

1. An attacker compromises the xhscover npm publisher, publishing process, or package distribution channel.
2. The attacker publishes a malicious release under the existing package name.
3. A user or Agent runs scripts/xhs-cover.sh or one of the documented npx xhscover commands on a system ...[truncated 1062 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin xhscover to an exact reviewed version instead of resolving the latest available release.

2. Add a package.json and committed lockfile containing registry integrity metadata.

3. Install dependencies using a deterministic command such as:

   bash

   npm ci --ignore-scripts
   

   If the package legitimately requires lifecycle scripts, review them before allowing execution rather than enabling them by default.

4. Invoke only the locally installed, locked binary and prohibit network fallback:

   bash

   exec npx --no-install xhscover "$@"
   

   Alternatively, execute ./node_modules/.bin/xhscover directly after verifying installation.

5. Review upstream source and release changes before updating the pinned version. Use automated dependency scanning and verify package provenance where supported.

6. Run the Skill with least privilege and restrict access to unrelated credentials and sensitive workspace files.

7. Update all commands in README.md and SKILL.md so users are not instructed to execute an unpinned package directly.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (16)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The README instructs users to run npx xhscover setup without pinning a specific package version. npx may fetch and execute the latest published package at runtime, so if the package is compromised, typo-squatted, or a malicious update is published, users could execute attacker-controlled code on their machine. In a skill context, this is more dangerous because the documentation directly encourages installation and first-run setup that stores credentials locally.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

This usage example invokes npx xhscover generate ... without a pinned version, which can execute whatever package version is current at invocation time. That creates a supply-chain risk where a compromised npm release could run arbitrary code during a normal cover-generation workflow. Because the skill is meant for end users and advertises easy execution, the attack surface is increased.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The unpinned npx xhscover generate command allows dynamic retrieval and execution of the latest npm package version. If that package or one of its publish permissions is compromised, an attacker could deliver malicious code under the trusted package name and gain code execution on user systems. Since this skill processes user prompts and may interact with locally stored API keys, compromise could also expose secrets.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

Using npx xhscover balance without a pinned version exposes users to the same supply-chain execution risk as other unpinned npx commands. A malicious update could execute arbitrary code when users only intend to query account metadata, making the trust boundary non-obvious. The presence of locally stored API keys in ~/.xhscover increases the value of such an attack.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The README recommends npx xhscover history 20 without version pinning, so execution depends on the current npm state rather than a reviewed artifact. If the package supply chain is compromised, even benign read-only workflows like viewing history could become a vehicle for arbitrary code execution or credential theft. In this skill, that risk is amplified by the package's expected access to stored API credentials and user-generated content.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

Referencing npx xhscover in the architecture description normalizes transient execution of an unpinned npm package as part of the trusted workflow. While less directly actionable than a shell snippet, it still encourages a pattern where users or integrators execute whatever version is currently published, enabling supply-chain abuse. Given the skill's registration flow and local API key storage, successful exploitation could lead to credential access and local code execution.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation scope includes broad triggers such as generating social-media cover images, article illustrations, and even asking about credit balance or history, which could match many ordinary user requests beyond a narrow explicit opt-in for this third-party service. In this skill, over-broad activation is more dangerous because using the skill sends API keys and user content to an external service, so accidental invocation can cause unintended data disclosure or tool execution.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The skill depends on invoking npx to fetch and run xhscover without pinning a specific package version. This creates a supply-chain risk: a future malicious or compromised package release could be executed automatically in the user's environment, and this skill also handles API keys, increasing the sensitivity of compromise.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

Using npx xhscover without a pinned version allows arbitrary future package updates to change what code is executed at runtime. Because the skill explicitly states that API keys and user content are sent through this tool, a malicious package update could exfiltrate secrets or execute unwanted local actions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The setup command npx xhscover setup will download and execute the latest package version unless explicitly pinned. That is especially risky for first-run setup flows because they often collect credentials or tokens and may modify local configuration.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The documented generate command executes an unpinned package via npx, exposing users to supply-chain compromise from any future package release. Since generation involves sending user-provided text and likely using stored API credentials, compromise could leak private content and secrets.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

This command variant also relies on npx xhscover without version pinning, so the executed code can drift over time or be replaced by a malicious package release. The skill context increases risk because the tool processes user content and may access previously configured API keys.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The balance command still executes unpinned remote package code, which could access local config and API keys even though the user intent is only to query account status. The direct business action is lower risk than setup or generation, but the supply-chain execution risk remains substantial.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The data-flow section confirms the skill routes API keys and content through npx xhscover, but that tool is not version-pinned anywhere in the skill. This combination makes the unpinned execution more dangerous because a compromised package could directly harvest both authentication material and user data.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

Executing npx xhscover without a pinned version allows npx to resolve and run whatever package version is current at execution time, introducing a supply-chain risk. If the upstream package is compromised, typosquatted, or a malicious version is published, the skill would execute attacker-controlled code on the host when users invoke the cover-generation workflow.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.