Security audit

xiaohongshu ｜小红书 AI 宣传图、图文笔记和视频发布技能

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Xiaohongshu content-generation and publishing tool, with sensitive account-cookie use clearly tied to its stated purpose.

Install only if you are comfortable giving the skill API keys for AI generation and a Xiaohongshu cookie that can act as your account. Use dry-run before publishing, review generated title/description/media first, avoid confidential or personal data in prompts, and keep XHS_COOKIE out of files and version control.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill documentation describes capabilities to read environment variables (including XHS_COOKIE and API keys) and read/write local files, but it does not declare permissions. This creates a trust and transparency gap: a host may expose sensitive secrets or filesystem access to the skill without explicit user awareness, which is especially relevant here because the skill can publish to a social-media account using an authentication cookie.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The script sends user-supplied descriptions, generated marketing copy, and image prompts to third-party AI providers, but it does not present an explicit disclosure, consent prompt, or data-handling warning before transmission. In a content-publishing skill, users may include proprietary product plans, customer data, or unpublished campaign material, so silent exfiltration to external APIs creates a real confidentiality and compliance risk.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The script performs an irreversible external action by publishing content to a real Xiaohongshu account using the live XHS_COOKIE session, yet it explicitly states that it no longer performs interactive confirmation and proceeds directly unless --dry-run is chosen. In an agent-skill context, this is risky because user prompts, tool-chaining mistakes, or prompt injection elsewhere in the workflow could trigger an unintended post to a real social-media account without a final human approval gate.

Missing User Warnings

Medium

Confidence: 79% confidence
Finding: User prompts are sent to a third-party AI endpoint without any in-code consent, minimization, or warning path, which can expose sensitive business, personal, or unpublished marketing content to an external provider. In this skill context, users may submit promotional copy or other private materials, making undisclosed outbound transmission a meaningful privacy and data-governance risk.

Missing User Warnings

Medium

Confidence: 82% confidence
Finding: Image prompts are transmitted to an external image-generation service with no visible disclosure or consent control in this code path. Because this skill is designed for marketing asset creation and publishing, prompts may contain confidential campaign plans, brand strategy, or personal data, so silent third-party transmission increases privacy and compliance exposure.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: User-supplied descriptions are transmitted to external AI providers for text and image generation without any explicit notice, consent checkpoint, or data-sensitivity guard. If users include confidential business plans, personal data, or unpublished media details, the skill may exfiltrate that information to third-party services contrary to user expectations.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The script performs an irreversible external action: it publishes content to a live Xiaohongshu account using the user's session cookie, and it does so immediately once invoked unless --dry-run is used. In an agent-skill context, that is dangerous because a prompt misunderstanding, tool misuse, or indirect prompt injection could cause unintended public posting from a real account without a final human confirmation step.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.