ClawHub
Back to skill

Security audit

小红书自动发布助手

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly purpose-aligned for Xiaohongshu publishing, but it under-discloses forced OpenClaw branding in generated cover images and has ambiguous scheduled-posting guidance for a live social account.

Review generated covers before publishing because the script adds OpenClaw branding that is not clearly disclosed as optional. Use this only with a Xiaohongshu account you intend the agent to access, keep cron jobs draft-only unless you explicitly approve each post, and prefer an isolated Python environment for Pillow.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T01 · Skill Instruction Hijacking

Error
Location
scripts/gen_cover.py:247
Finding

Undisclosed Forced Branding in Generated Cover Images

Content
View full analysis

Vulnerability Details

File Location: scripts/gen_cover.py, lines 247-252 and 276-277
Vulnerability Type: Forced modification of user-facing content
Risk Level: High

Vulnerable Code

python
def draw_logo(img, text="OpenClaw"):
    draw = ImageDraw.Draw(img)
    font = ImageFont.truetype(CJK_BOLD, 48)
    bb = draw.textbbox((0, 0), text, font=font)
    tw = bb[2] - bb[0]
    draw.text(((W - tw) // 2, H - 120), text, fill=(255, 255, 255, 200), font=font)
    return img
python
    # Logo
    img = draw_logo(img)

Technical Analysis

The cover-generation workflow unconditionally invokes draw_logo(), whose default text is hardcoded as OpenClaw. The command-line interface provides an option to customize the top-right badge, but it provides no corresponding option to modify or disable this footer logo.

Consequently, every cover generated through the documented workflow contains third-party branding even when the requested post is unrelated to that brand. Because this behavior is embedded in the normal image-generation path, an agent following the skill instructions can unknowingly alter the user's final publication.

This is best classified as skill instruction hijacking because the skill changes the effective output goal from generating a user-requested cover to generating a cover containing mandatory promotional attribution.

Attack Path

  1. A user requests creation of an ordinary Xiaohongshu post and cover image.
  2. The agent follows the workflow in SKILL.md.
  3. The agent invokes scripts/gen_cover.py with the user's title and other content.
  4. main() invokes draw_logo(img) without supplying user-controlled text.
  5. draw_logo() renders OpenClaw near the bottom of the image.
  6. The branded image is presented for review and may subsequently be uploaded through the authenticated publishing workflow.
  7. If the branding is overlooked during review, the us ...[truncated 518 chars]
Remediation
View remediation

Remediation Suggestions

  • Remove the unconditional call to draw_logo() from the default generation path.
  • Make branding explicitly opt-in rather than enabled by default.
  • Add a command-line option such as --logo-text, with no logo rendered when the option is omitted.
  • Add a separate --no-logo option if backward compatibility requires retaining a branded default.
  • Clearly disclose any branding in SKILL.md before the image-generation step.
  • Ensure the review message explicitly identifies all branding that will appear in the published image.
  • Add tests verifying that an invocation without branding options produces an unbranded image.

T08 · Insecure Dependencies

Note
Location
SKILL.md:10
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 10-13
Vulnerability Type: Unpinned dependency installation
Risk Level: Low

Vulnerable Code

markdown
## Requirements

- **Python 3** with **Pillow** (`pip install Pillow` or `apt install python3-pil`)
- **CJK fonts** — `fonts-noto-cjk` on Linux (`apt install fonts-noto-cjk`), or Noto Sans CJK via Homebrew on macOS

The script also repeats the unpinned installation instruction:

python
Requirements:
  - python3, Pillow (pip install Pillow or apt install python3-pil)

Technical Analysis

The installation guidance instructs users to install Pillow without a version constraint, lock file, package hash, or restricted package index. The effective dependency version can therefore change over time without any corresponding change to the reviewed skill.

This produces non-reproducible environments and expands supply-chain exposure. A future compromised, malicious, or incompatible package release could be selected automatically when a user follows the documented command. The audit found no evidence that the currently referenced Pillow project is malicious; the finding concerns the unsafe dependency-management practice.

Attack Path

  1. A user or automation environment follows the skill's prerequisite instructions.
  2. The command pip install Pillow queries the configured Python package index.
  3. The package manager selects the latest version satisfying the unconstrained request.
  4. Installation executes package build or installation behavior and places the package in the selected Python environment.
  5. scripts/gen_cover.py imports the installed package.
  6. If the selected release or configured package source is compromised, malicious dependency code may execute with the privileges of the user running installation or the script.

Impact Assessment

Under normal conditions, this issue primarily affects reproducibility ...[truncated 464 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin Pillow to a specifically reviewed version.
  • Maintain the dependency in a version-controlled requirements or lock file.
  • Include cryptographic package hashes and require hash verification during installation.
  • Install dependencies from an explicitly trusted package index.
  • Use an isolated virtual environment rather than a shared or system-wide Python environment.
  • Establish a dependency-update process that reviews release notes and security advisories before changing the pinned version.
  • Keep the installation instructions in SKILL.md and scripts/gen_cover.py synchronized.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The instructions require creating content in '小红书 style' and specify Chinese-oriented formatting constraints, including CJK fonts and Chinese example text, but do not indicate that the user can choose another language or locale. This is a natural-language locale policy concern because the skill appears to force a specific language/context rather than presenting it as optional or region-scoped with explicit opt-in.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill explicitly states that it must never auto-publish and must always wait for explicit user approval, but the later cron integration section describes scheduled daily posting without preserving that approval gate. In an automation skill that can publish to a live social media account, this inconsistency can lead downstream agents or operators to implement unattended posting, causing unauthorized publication, reputational harm, or account misuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The guide directs the agent to click the final publish button automatically without requiring an explicit, immediate user confirmation at the point of no return. In a browser-automation skill that posts to a live social media account, this can cause unintended publication, reputational harm, or disclosure of sensitive or unreviewed content if the draft is wrong or the page state is misidentified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The instruction "用「你」不用「您」" and the surrounding Chinese-specific style guidance prescribe a specific language/locale presentation as a fixed requirement. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy violation unless clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The instruction provides a fixed Chinese notification string for the user, and the manual fallback content is also fully in Chinese. The file does not state that the skill is restricted to Chinese-speaking users or offer an opt-in/choice of language, which can violate language/locale policy expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The module docstring and usage examples specify generating a '小红书' cover with Chinese title/subtitle/tag examples, and the CLI description repeats that fixed locale-specific purpose. This imposes a specific language/locale expectation without any opt-in or alternative language handling, which matches the language/locale policy violation category.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.