ClawHub
Back to skill

Security audit

XiaoHongShu

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a Xiaohongshu content helper, but its install script can recursively run npm installs and exhaust local resources.

Review this package before installing. The content-generation behavior itself is narrow and disclosed, but do not run npm install as-is unless the recursive install script is removed and the dependency lockfile is regenerated from trusted sources.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
package.json:39
Finding

Recursive npm Install Lifecycle Causes Resource Exhaustion

Content
View full analysis

Vulnerability Details

File Location: package.json:39-41
Vulnerability Type: Recursive package lifecycle execution and denial of service
Risk Level: High

Vulnerable Code

json
"scripts": {
  "install": "npm install",

Technical Analysis

npm automatically executes the install lifecycle script while installing a package. The configured lifecycle script starts another npm install process in the same project. That nested installation can invoke the same lifecycle script again, resulting in recursive npm process creation.

The behavior requires no malicious command-line input. It is triggered through the standard installation procedure documented by the project. Each process runs with the privileges of the user performing the installation.

Attack Path

  1. A user obtains the package and follows the documented installation instructions.
  2. The user runs npm install in the project directory.
  3. npm reaches the package lifecycle stage and executes the install script.
  4. The script launches another npm install.
  5. The nested npm process executes the same lifecycle script, repeating the cycle.
  6. Recursive processes consume CPU, memory, process-table entries, and installation time until the operation fails, is terminated, or makes the host unstable.

Impact Assessment

The issue primarily affects availability. It can prevent installation and consume resources belonging to the current user. On constrained build agents, containers, or shared CI systems, it may terminate jobs or interfere with other workloads.

It does not independently grant elevated privileges, persistent access, or access beyond the permissions of the user running npm. Its scope is the local installation environment and any shared resources available to that environment.

Remediation
View remediation

Remediation Suggestions

  1. Remove the custom install lifecycle script. npm already installs dependencies without this script.

  2. Retain only scripts that invoke the application directly, for example:

    json
    "scripts": {
  "start": "node content-creator/index.js",
  "optimize": "node content-creator/index.js optimize",
  "generate": "node content-creator/index.js generate",
  "titles": "node content-creator/index.js titles",
  "hashtags": "node content-creator/index.js hashtags",
  "analyze": "node content-creator/index.js analyze"
}

  3. Test installation in a clean, resource-limited container using npm ci.

  4. Add CI validation that rejects lifecycle scripts which recursively invoke package installation.

  5. Review all future npm lifecycle hooks because they execute automatically and with the installing user's privileges.

T08 · Insecure Dependencies

Warning
Location
package.json:46
Finding

Declared Dependency Is Not Represented in the Lockfile

Content
View full analysis

Vulnerability Details

File Location: package.json:46-48 and package-lock.json:1-6
Vulnerability Type: Unlocked third-party dependency resolution
Risk Level: Medium

Vulnerable Code

package.json declares a third-party dependency with a version range:

json
"dependencies": {
  "@ai-sdk/google": "^1.0.0"
}

The committed lockfile contains no package records:

json
{
  "name": "xiaoHongShu",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {}
}

Technical Analysis

The dependency manifest and lockfile are inconsistent. The declared @ai-sdk/google package and its transitive dependency graph have no committed resolved versions or integrity hashes.

Consequently, installation cannot rely on the repository lockfile to reproduce an audited dependency graph. The caret range permits npm to select compatible releases newer than the initially intended version. This does not prove that the dependency is malicious, but it weakens supply-chain controls and permits later registry state to influence installed code.

The application imports the package at content-creator/index.js:12, although the imported AI value is not otherwise used.

Attack Path

  1. A user or CI job runs package installation.
  2. npm observes that the declared dependency is absent from the lockfile.
  3. npm resolves an available version matching ^1.0.0 and resolves its transitive dependencies from the configured registry.
  4. The resulting dependency graph may differ from versions previously reviewed or tested.
  5. If a subsequently resolved release or transitive package is compromised, vulnerable, or malicious, its code may run during package lifecycle hooks or when imported by the application.

Exploitation therefore depends on an unsafe or compromised dependency release, registry, or transitive dependency; no such compromise was confirmed in the audited files.

Impact Assessment

...[truncated 558 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove @ai-sdk/google if it is not needed; the current implementation imports it but does not use it.

  2. If it is required, regenerate the lockfile from a trusted registry and commit the complete result:

    bash
    rm package-lock.json
npm install
npm ci

    Perform this only after removing the recursive install lifecycle script.

  3. Review the resolved package versions, transitive dependencies, registry sources, integrity hashes, and lifecycle scripts before committing the lockfile.

  4. Use npm ci in CI and production so installation fails when the manifest and lockfile are inconsistent.

  5. Consider pinning the direct dependency to an explicitly reviewed version and use controlled dependency-update automation.

  6. Run dependency vulnerability and provenance checks as part of CI.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · content-creator/index.js (reported line 69)May include surrounding context.

js
`${content.split(' ')[0]}新手必看：${content.substring(0, 50)}`
  ];
  
  return prompts.map(prompt => {
    // 这里可以集成 AI 模型进行优化
    return prompt + ' 🎯';
  });

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · content-creator/index.js (reported line 71)May include surrounding context.

js
`${content.split(' ')[0]}新手必看：${content.substring(0, 50)}`
  ];
  
  return prompts.map(prompt => {
    // 这里可以集成 AI 模型进行优化
    return prompt + ' 🎯';
  });

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The file’s natural-language descriptions and prompt templates are entirely in Chinese and tailored specifically to 小红书 content creation, without offering any language or locale choice. Under the policy, forcing a specific language without explicit user opt-in can be a locale/language policy violation unless clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill documentation is entirely in Chinese and is specifically framed around generating content for 小红书, but it does not state whether users may choose another language or whether Chinese is a required locale constraint. This can violate language/locale policy expectations when a skill implicitly forces a specific language without explicit opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The entire skill description, headings, examples, and generated-content framing are presented only in Chinese, with no indication that users may choose another language or that the restriction is required for a documented regional/compliance reason. Under the policy rule, a forced language or locale without opt-in can be a natural-language policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The package description is written entirely in Chinese and presents the skill as a Chinese-platform content creation tool without indicating any language choice or opt-in. Under the policy rules, forcing a specific language or locale without user choice can be a natural-language policy violation unless clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
88% confidence
Finding

The dependency uses a caret range (^1.0.0), which allows automatic installation of newer minor and patch releases. In a skill context that relies on an external AI SDK, this can introduce unexpected behavior or supply-chain risk if a future release is compromised or incompatible.

Content

Scanner excerpt · package.json (reported line 49)May include surrounding context.

json
"analyze": "node content-creator/index.js analyze"
  },
  "dependencies": {
    "@ai-sdk/google": "^1.0.0"
  }
}

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

This file contains the literal text "小红书" in the rendered asset, which fixes the visible language to Chinese with no indication of user choice or opt-in. The policy explicitly calls for flagging language or locale constraints when they are forced rather than optional or justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.