Social Push Semi

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:03 AM UTC
• Version: 1.0.1

Overview

This skill is meant to help prepare Xiaohongshu posts, but it bundles under-disclosed tools that can publish, comment, read account data, and send API keys to configurable network destinations.

Review this carefully before installing. Use it only with a Xiaohongshu account you are comfortable automating, avoid invoking the bundled vendor publish commands directly, do not provide untrusted --base-url or --api-key-env values, and avoid untrusted media URLs. Treat the Chrome profile it creates as an authenticated session store.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/generate_images_doubao.py:21

Finding

Arbitrary API endpoint can receive the configured API key

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: vendor/xhs/scripts/publish_pipeline.py:574

Finding

Publishing pipeline automatically publishes by default despite the declared manual-confirmation boundary

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: vendor/xhs/scripts/image_downloader.py:83

Finding

Unrestricted media URL downloads permit SSRF and unbounded resource consumption

Content

View full analysis

str: """ Download a single image and return the local file path. """ parsed = urlparse(url) if referer is None: referer = f"{parsed.scheme}://{parsed.netloc}/" headers = { "Referer": referer, "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) " "AppleWebKit/537.36 (KHTML, like Gecko) " "Chrome/120.0.0.0 Safari/537.36", } resp = requests.get(url, timeout=DEFAULT_TIMEOUT, stream=True, headers=headers) resp.raise_for_status() ext = self._guess_extension(url, resp.headers.get("Content-Type")) filename = f"{uuid.uuid4().hex[:12]}{ext}" filepath = os.path.join(self.temp_dir, filename) with open(filepath, "wb") as f: for chunk in resp.iter_content(chunk_size=8192): f.write(chunk) ``` The video path has the same issue: ```python resp = requests.get( url, timeout=DEFAULT_TIMEOUT * 4, stream=True, headers=headers ) resp.raise_for_status() ext = self._guess_video_extension(url, resp.headers.get("Content-Type")) filename = f"{uuid.uuid4().hex[:12]}{ext}" filepath = os.path.join(self.temp_dir, filename) with open(filepath, "wb") as f: for chunk in resp.iter_content(chunk_size=65536): f.write(chunk) ``` ### Technical Analysis The publishing pipeline accepts media URLs and passes them directly to `requests.get`. The downloader does not restrict: - URL schemes - Loopback, private, link-local, or reserved IP ranges - Internal DNS names - Redirect targets - Destination ports - Response MIME types - Response size - Actual file signatures As a result, the ...[truncated 2398 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/setup_vendor_xhs.sh:17

Finding

Dependency installation uses unpinned versions and upgrades build tooling at install time

Content

View full analysis

=2.28.0 websockets>=12.0 ``` ### Technical Analysis Every setup run can install the newest available versions of `pip`, `setuptools`, `wheel`, `requests`, `websockets`, and their transitive dependencies. There are no exact versions, hashes, lock file, upper bounds, or trusted-index restrictions. This makes installation non-reproducible: code reviewed during the audit is not sufficient to determine what dependency code will execute in a future installation. A compromised upstream release, account takeover, malicious transitive release, or incompatible future version can enter the environment without a project code change. Upgrading package-management and build tooling during normal setup further broadens the executable supply-chain surface. Python package installation can execute build backends and installation-related code with the privileges of the user running the setup script. No evidence was found that the named packages are currently malicious; the finding concerns the unsafe installation policy and inability to reproduce the audited dependency set. ### Attack Path 1. A malicious or compromised package version becomes available from the configured package index. 2. The user runs `setup_vendor_xhs.sh`. 3. The unconstrained `-U` command and lower-bound requirements select the newer version. 4. Package installation or import executes attacker-controlled dependency code inside the user's environment. 5. The code can access files, environment variables, browser profile data avai ...[truncated 554 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (40)

Tainted flow: 'headers' from os.environ.get (line 39, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/generate_images_doubao.py (reported line 49)May include surrounding context.

python

"size": args.size,
            "n": 1,
        }
        resp = requests.post(endpoint, headers=headers, json=payload, timeout=120)
        if resp.status_code >= 300:
            print(f"API error {resp.status_code}: {resp.text[:400]}", file=sys.stderr)
            sys.exit(3)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

If the actual behavior auto-publishes by default, controls browser/login sessions, downloads/uploads media, and does not even perform the claimed package-generation workflow, users are being misled about both safety controls and functional scope. Misrepresentation of human-confirmation requirements is particularly dangerous because it can cause unintended account actions under a logged-in browser session.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

If the actual behavior auto-publishes by default, controls browser/login sessions, downloads/uploads media, and does not even perform the claimed package-generation workflow, users are being misled about both safety controls and functional scope. Misrepresentation of human-confirmation requirements is particularly dangerous because it can cause unintended account actions under a logged-in browser session.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

If the actual behavior auto-publishes by default, controls browser/login sessions, downloads/uploads media, and does not even perform the claimed package-generation workflow, users are being misled about both safety controls and functional scope. Misrepresentation of human-confirmation requirements is particularly dangerous because it can cause unintended account actions under a logged-in browser session.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file exposes CLI commands that go beyond a 'manual confirmation before publishing' scaffold and can directly perform publish and other account actions. This mismatch is security-relevant because operators or upstream agents may trust the description and invoke the skill under false assumptions, causing unintended external actions on a logged-in account.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script includes capabilities for feed discovery, detail scraping, comment posting, notification harvesting, and analytics capture that materially exceed a semi-automatic publishing scaffold. In agent settings, hidden overbroad capabilities increase the risk of data collection and unsolicited account actions being triggered without informed consent or least-privilege controls.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Although the workflow messaging says the user should review before publishing, the CLI 'publish' branch immediately invokes _click_publish() and reports PUBLISH_STATUS: PUBLISHED. This creates a direct path for irreversible external posting without a human checkpoint, which is especially dangerous for agent-driven execution.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script behavior explicitly defaults to publishing posts immediately after form fill, which contradicts the stated skill description that the final publish step is manually confirmed. In an automation skill that can operate browser-driven actions against a live social account, this mismatch is dangerous because callers may reasonably expect a safe preview/package-generation flow but instead trigger irreversible external posting.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The implementation performs real browser automation that fills the Xiaohongshu form and invokes the publish button, rather than only preparing a publish package for later manual action. Given the skill description promises semi-automatic posting with final human confirmation, this creates a capability overreach that can cause unintended live posts to a real account and breaks the user's trust model.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence

Finding

The skill exposes operational behavior that clearly depends on sensitive capabilities such as shell, filesystem access, environment access, and likely network/CDP interaction, but it declares no explicit tool scope or permission boundaries. That increases the chance of over-broad execution, hidden side effects, and user misinformed consent about what the skill may access or modify.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The skill instructs users to connect to a logged-in Xiaohongshu session and auto-fill content into a publish page, but it does not provide a clear warning that the tool will act through an authenticated account and may access or use account-associated data. In the context of social publishing automation, missing consent and safety language makes accidental account actions and privacy misunderstandings more likely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script builds a remote API endpoint, reads an API key from an environment variable, and sends the prompt and bearer token in an HTTP request. While network access is central to image generation, the file contains no docstring, comment, or argument help warning that user input and credentials are sent to an external service.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The code unconditionally appends Chinese-language instructions to every prompt, imposing a specific language regardless of the user's original locale or preferences. This is a natural-language policy issue because it forces a language choice without offering an opt-in or configuration.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/generate_images_doubao.py (reported line 49)May include surrounding context.

python

"size": args.size,
            "n": 1,
        }
        resp = requests.post(endpoint, headers=headers, json=payload, timeout=120)
        if resp.status_code >= 300:
            print(f"API error {resp.status_code}: {resp.text[:400]}", file=sys.stderr)
            sys.exit(3)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file contains Chinese-only natural-language comments and status messages, and the CLI usage also mixes Chinese terms, which imposes a specific language on users without opt-in. This matches the language/locale policy violation category because no alternative language or user choice is provided.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This shell script emits user-facing content entirely in Chinese, including the usage string, generated markdown, JSON reason text, and checklist. Because the file provides no option to select another language or indicate that the skill is intentionally region-specific, it violates the language/locale policy criteria for forced language without user opt-in.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The generated publish-pack sets "autoUpload": true even though the skill is described as semi-automatic with final human confirmation. Uploading content before a human review can leak unintended, noncompliant, or sensitive media to the platform and undermines the safety boundary the documentation claims to preserve.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script defines DOUBAO_API_KEY as the credential source and later uses it to call a remote image-generation API. While the script prints progress messages, it does not disclose that a credential will be read from the environment and used for an outbound network request.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script sends user-supplied topic, audience, and optional image description content to a third-party remote API for prompt-based image generation without an explicit warning or consent step in the script. In this skill context, that data flow is expected for functionality, but it can still expose potentially sensitive business plans, campaign ideas, or personal data if users enter them unknowingly.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This markdown template is entirely written in Chinese and provides no indication that users may choose another language or that the skill is intentionally limited to a Chinese-language context. Under the language/locale policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The remove_account flow can recursively delete a Chrome profile directory via shutil.rmtree(profile_dir) when --delete-profile is passed. Although the CLI help mentions the deletion option, the code performs the irreversible deletion without a confirmation prompt or explicit runtime warning at the point of action.

Content

No source excerpt is available for this finding.

Dynamic Request Target

Medium

• Category: Server-Side Request Forgery
• Confidence: 60% confidence

Finding

Request target host is built from a dynamic or untrusted value. If the host is attacker-influenced, this enables SSRF to arbitrary internal or metadata endpoints.

Content

Scanner excerpt · vendor/xhs/scripts/cdp_publish.py (reported line 468)May include surrounding context.

python

return pages[0]["webSocketDebuggerUrl"]

        # Create a new tab
        resp = requests.put(
            f"http://{self.host}:{self.port}/json/new?{XHS_CREATOR_URL}",
            timeout=5,
        )

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Like and collect/bookmark automation are unrelated to the advertised publishing workflow and introduce additional engagement-manipulation actions on the user's account. Even if not wired into the main CLI path here, retaining latent action primitives in a skill broadens misuse potential and undermines operator trust about what the tool can do.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The comment-posting path performs a live external account action immediately after content is provided, with no confirmation, preview, or warning. In an agent context this can generate unsolicited interactions, spam, reputational harm, or policy violations on behalf of the logged-in user.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · vendor/xhs/scripts/chrome_launcher.py (reported line 155)May include surrounding context.

python

print(f"  profile dir: {user_data_dir}")
    print(f"  debug port : {port}")

    proc = subprocess.Popen(
        cmd,
        stdout=subprocess.DEVNULL,
        stderr=subprocess.DEVNULL,

Static analysis

No suspicious patterns detected.