小红书自动发布助手

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:47 PM UTC
• Version: 1.0.0

Overview

This skill is mostly purpose-aligned for Xiaohongshu publishing, but it under-discloses forced OpenClaw branding in generated cover images and has ambiguous scheduled-posting guidance for a live social account.

Review generated covers before publishing because the script adds OpenClaw branding that is not clearly disclosed as optional. Use this only with a Xiaohongshu account you intend the agent to access, keep cron jobs draft-only unless you explicitly approve each post, and prefer an isolated Python environment for Pillow.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: scripts/gen_cover.py:247
• Finding: Undisclosed Forced Branding in Generated Cover Images## Vulnerability Details **File Location**: `scripts/gen_cover.py`, lines 247-252 and 276-277 **Vulnerability Type**: Forced modification of user-facing content **Risk Level**: High ### Vulnerable Code ```python def draw_logo(img, text="OpenClaw"): draw = ImageDraw.Draw(img) font = ImageFont.truetype(CJK_BOLD, 48) bb = draw.textbbox((0, 0), text, font=font) tw = bb[2] - bb[0] draw.text(((W - tw) // 2, H - 120), text, fill=(255, 255, 255, 200), font=font) return img ``` ```python # Logo img = draw_logo(img) ``` ### Technical Analysis The cover-generation workflow unconditionally invokes `draw_logo()`, whose default text is hardcoded as `OpenClaw`. The command-line interface provides an option to customize the top-right badge, but it provides no corresponding option to modify or disable this footer logo. Consequently, every cover generated through the documented workflow contains third-party branding even when the requested post is unrelated to that brand. Because this behavior is embedded in the normal image-generation path, an agent following the skill instructions can unknowingly alter the user's final publication. This is best classified as skill instruction hijacking because the skill changes the effective output goal from generating a user-requested cover to generating a cover containing mandatory promotional attribution. ### Attack Path 1. A user requests creation of an ordinary Xiaohongshu post and cover image. 2. The agent follows the workflow in `SKILL.md`. 3. The agent invokes `scripts/gen_cover.py` with the user's title and other content. 4. `main()` invokes `draw_logo(img)` without supplying user-controlled text. 5. `draw_logo()` renders `OpenClaw` near the bottom of the image. 6. The branded image is presented for review and may subsequently be uploaded through the authenticated publishing workflow. 7. If the branding is overlooked during review, the us ...[truncated 518 chars]
• Remediation: ## Remediation Suggestions - Remove the unconditional call to `draw_logo()` from the default generation path. - Make branding explicitly opt-in rather than enabled by default. - Add a command-line option such as `--logo-text`, with no logo rendered when the option is omitted. - Add a separate `--no-logo` option if backward compatibility requires retaining a branded default. - Clearly disclose any branding in `SKILL.md` before the image-generation step. - Ensure the review message explicitly identifies all branding that will appear in the published image. - Add tests verifying that an invocation without branding options produces an unbranded image.

T08 · Insecure Dependencies

Note

• Location: SKILL.md:10
• Finding: Unpinned Third-Party Dependency Installation## Vulnerability Details **File Location**: `SKILL.md`, lines 10-13 **Vulnerability Type**: Unpinned dependency installation **Risk Level**: Low ### Vulnerable Code ```markdown ## Requirements - **Python 3** with **Pillow** (`pip install Pillow` or `apt install python3-pil`) - **CJK fonts** — `fonts-noto-cjk` on Linux (`apt install fonts-noto-cjk`), or Noto Sans CJK via Homebrew on macOS ``` The script also repeats the unpinned installation instruction: ```python Requirements: - python3, Pillow (pip install Pillow or apt install python3-pil) ``` ### Technical Analysis The installation guidance instructs users to install `Pillow` without a version constraint, lock file, package hash, or restricted package index. The effective dependency version can therefore change over time without any corresponding change to the reviewed skill. This produces non-reproducible environments and expands supply-chain exposure. A future compromised, malicious, or incompatible package release could be selected automatically when a user follows the documented command. The audit found no evidence that the currently referenced Pillow project is malicious; the finding concerns the unsafe dependency-management practice. ### Attack Path 1. A user or automation environment follows the skill's prerequisite instructions. 2. The command `pip install Pillow` queries the configured Python package index. 3. The package manager selects the latest version satisfying the unconstrained request. 4. Installation executes package build or installation behavior and places the package in the selected Python environment. 5. `scripts/gen_cover.py` imports the installed package. 6. If the selected release or configured package source is compromised, malicious dependency code may execute with the privileges of the user running installation or the script. ### Impact Assessment Under normal conditions, this issue primarily affects reproducibility ...[truncated 464 chars]
• Remediation: ## Remediation Suggestions - Pin Pillow to a specifically reviewed version. - Maintain the dependency in a version-controlled requirements or lock file. - Include cryptographic package hashes and require hash verification during installation. - Install dependencies from an explicitly trusted package index. - Use an isolated virtual environment rather than a shared or system-wide Python environment. - Establish a dependency-update process that reviews release notes and security advisories before changing the pinned version. - Keep the installation instructions in `SKILL.md` and `scripts/gen_cover.py` synchronized.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Natural-Language Policy Violations

Medium

• Confidence: 86% confidence
• Finding: The instructions require creating content in '小红书 style' and specify Chinese-oriented formatting constraints, including CJK fonts and Chinese example text, but do not indicate that the user can choose another language or locale. This is a natural-language locale policy concern because the skill appears to force a specific language/context rather than presenting it as optional or region-scoped with explicit opt-in.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The skill explicitly states that it must never auto-publish and must always wait for explicit user approval, but the later cron integration section describes scheduled daily posting without preserving that approval gate. In an automation skill that can publish to a live social media account, this inconsistency can lead downstream agents or operators to implement unattended posting, causing unauthorized publication, reputational harm, or account misuse.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The guide directs the agent to click the final publish button automatically without requiring an explicit, immediate user confirmation at the point of no return. In a browser-automation skill that posts to a live social media account, this can cause unintended publication, reputational harm, or disclosure of sensitive or unreviewed content if the draft is wrong or the page state is misidentified.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The instruction "用「你」不用「您」" and the surrounding Chinese-specific style guidance prescribe a specific language/locale presentation as a fixed requirement. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy violation unless clearly justified as region-specific.

Natural-Language Policy Violations

Low

• Confidence: 93% confidence
• Finding: The instruction provides a fixed Chinese notification string for the user, and the manual fallback content is also fully in Chinese. The file does not state that the skill is restricted to Chinese-speaking users or offer an opt-in/choice of language, which can violate language/locale policy expectations.

Natural-Language Policy Violations

Low

• Confidence: 89% confidence
• Finding: The module docstring and usage examples specify generating a '小红书' cover with Chinese title/subtitle/tag examples, and the CLI description repeats that fixed locale-specific purpose. This imposes a specific language/locale expectation without any opt-in or alternative language handling, which matches the language/locale policy violation category.

Static analysis

No suspicious patterns detected.