Security audit

luan-xhs-skill

Security checks for vulnerabilities and agentic risk

Overview

This skill is aimed at Xiaohongshu operations, but it can publish to a live account, saves reusable login state in plaintext, and includes broad OpenClaw installation/service setup.

Install only if you are comfortable giving the skill access to a live Xiaohongshu creator account and with OpenClaw gateway setup on the machine. Treat ~/.openclaw/workspace/xhs_user_info.json and gateway tokens as credentials, avoid sharing logs or screenshots, prefer dry-run/private visibility first, and avoid the hard/draft fallback publishers unless you have reviewed the target page state.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads

Findings (6)

T03 · Remote Payload Retrieval and Execution

Error

Location: Openclaw一键安装.md:27
Finding: Remote Installation Script Executed Directly Through a Shell Pipeline
Content: View full analysis
Remediation: View remediation

T06 · System Persistence

Error

Location: Openclaw一键安装.md:87
Finding: Installation Guide Registers and Starts a Persistent Gateway Service
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: Openclaw一键安装.md:60
Finding: Unpinned Global Installation of OpenClaw From the npm Registry
Content: View full analysis
/dev/null 2>&1; then return fi echo "[3/6] Installing openclaw..." npm i -g openclaw } ``` The English text in this reproduction translates the original informational message only; the executable commands are reproduced exactly. ### Technical Analysis The installer retrieves the current `openclaw` package release and its transitive dependencies without specifying an audited version, lockfile, expected integrity value, or provenance requirement. The package is installed globally, increasing its reach beyond this project. The audit found no evidence that the referenced package is currently malicious. The vulnerability is the unsafe and mutable supply-chain installation process: a future compromised release, maintainer account, package registry entry, or dependency could execute lifecycle scripts during installation and then run again through onboarding and gateway commands. ### Attack Path 1. An attacker compromises the `openclaw` npm package, a maintainer account, or a transitive dependency. 2. A malicious version becomes the registry’s current release. 3. A user runs the installation guide. 4. `npm i -g openclaw` installs the compromised package globally. 5. npm lifecycle scripts may execute during installation. 6. The script later invokes the compromised `openclaw` binary for onboarding and persistent gateway installation. ### Impact Assessment A malicious package or installation script would execute with the invoking user’s privileges. It could read user-accessible files and credentials, modify globally installed tooling, alter the OpenClaw workspace, steal session material, and establish persistence through the gateway setup. The global installation broadens the impact to unrelated projects and subse ...[truncated 32 chars]
Remediation: View remediation
`. 2. Verify npm package provenance and expected integrity metadata. 3. Document the publisher identity and approved package digest. 4. Prefer a project-local installation over a global installation. 5. Use a lockfile for project dependencies and review transitive dependency changes. 6. Disable unnecessary npm lifecycle scripts during installation where compatible. 7. Test and approve package updates before changing the pinned version. 8. Avoid automatically starting a newly installed package as a persistent service. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: scripts/xhs_login_qr.js:156
Finding: Reusable Xiaohongshu Authentication State Stored as Unprotected Plaintext
Content: View full analysis
[]); const storage = await page.evaluate(() => { const localStorageObj = {}; const sessionStorageObj = {}; try { for (let i = 0; i < localStorage.length; i++) { const k = localStorage.key(i); localStorageObj[k] = localStorage.getItem(k); } } catch {} try { for (let i = 0; i < sessionStorage.length; i++) { const k = sessionStorage.key(i); sessionStorageObj[k] = sessionStorage.getItem(k); } } catch {} return { localStorage: localStorageObj, sessionStorage: sessionStorageObj, url: location.href, title: document.title }; }).catch(() => ({ localStorage: {}, sessionStorage: {}, url: '', title: '' })); fs.writeFileSync(sessionPath, JSON.stringify({ localStorage: storage.localStorage, sessionStorage: storage.sessionStorage, cookies, capturedAt: new Date().toISOString(), url: storage.url, title: storage.title, via: 'creator_qr_login' }, null, 2)); ``` The SMS login path performs the same operation after successful authentication: ```javascript const cookies = await context.cookies().catch(() => []); const localStorageObj = await page.evaluate(() => { const out = {}; try { for (let i = 0; i < localStorage.length; i++) { const k = localStorage.key(i); out[k] = localStorage.getItem(k); } } catch {} return out; }).catch(() => ({})); const sessionStorageObj = await page.evaluate(() => { const out = {}; try { for (let i = 0; i < sessionStorage.length; i++) { const k = sessionStorage.key(i); out[k] = sessionStorage.getItem(k); } } catch {} return out; }).catch(() => ({})) ...[truncated 2074 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: Openclaw一键安装.md:97
Finding: Gateway Authentication Token Printed in Plaintext
Content: View full analysis
}" echo "Token: ${token:-}" echo "Dashboard: http://127.0.0.1:18789/" } ``` The English text in this reproduction translates the original informational messages only; the executable token-retrieval and output behavior is reproduced exactly. ### Technical Analysis The installation script retrieves the gateway authentication token and writes its full value to standard output. Authentication tokens should be treated as secrets and should not appear in installation logs. Terminal output may be captured by shell-session recording, CI/CD logs, remote support software, screen sharing, monitoring agents, scrollback buffers, or copied troubleshooting transcripts. The gateway currently appears intended for loopback use, which limits remote exposure, but any process or user with network access to the gateway’s actual listener could reuse the disclosed token. ### Attack Path 1. A user runs the installation script. 2. The script reads `gateway.auth.token`. 3. The complete token is printed to standard output. 4. The output is retained in a log, screen recording, support transcript, or terminal scrollback. 5. Another party obtains the token. 6. That party uses the token against the reachable OpenClaw gateway before it is rotated. ### Impact Assessment The attacker receives the authentication privileges associated with the gateway token. The exact operational scope depends on OpenClaw gateway configuration and network binding. On a loopback-only deploym ...[truncated 193 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/xhs_publish_draft_direct.js:25
Finding: Broad Draft Selection and Publish-Button Fallbacks Can Publish Unintended Content
Content: View full analysis
{ const nodes = Array.from(document.querySelectorAll('*')); const picks = []; for (const n of nodes) { try { const txt = (n.innerText || '').trim().replace(/\s+/g, ' '); if (!txt) continue; if ( txt.includes('draft') || (txt.includes('edit') && txt.includes('delete')) || txt.includes('temporarily saved') ) { const h = n.querySelector('h3') || n.querySelector('h2') || n.querySelector('strong'); const title = h ? (h.innerText || '').trim() : txt.split('\n')[0]; const rect = n.getBoundingClientRect(); if (rect && rect.width > 20 && rect.height > 10) { picks.push({ title: title.slice(0, 200), x: Math.round(rect.x + rect.width / 2), y: Math.round(rect.y + rect.height / 2) }); } } } catch (e) {} } return picks.slice(0, 10); }); if (!candidates || candidates.length === 0) { const editFound = await page.evaluate(() => { const nodes = Array.from(document.querySelectorAll('*')); const edit = nodes.find( n => (n.innerText || '').trim() === 'edit' || (n.innerText || '').trim().startsWith('edit') ); if (edit) { edit.click(); return true; } return false; }).catch(() => false); } else { const c = candidates[0]; await page.mouse.click(c.x, c.y).catch(() => {}); } ``` It then uses a broad final fallback that clicks any visible element containing the publish label: ```javascript ...[truncated 4287 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (33)

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The file’s content is materially unrelated to the declared Xiaohongshu operations skill and instead instructs users to install and administer a separate agent platform with OAuth and gateway/device controls. This mismatch expands the skill’s effective privileges and attack surface, making it easier to smuggle unrelated system-management behavior into a workflow where users would not reasonably expect it.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script provisions a local agent platform, performs OAuth onboarding, installs and starts a gateway service, and manages devices/tokens, none of which is necessary for ordinary Xiaohongshu posting tasks. In the context of this skill, that is dangerous because it introduces powerful local control-plane capabilities under the guise of social-media operations, increasing the risk of unauthorized access or lateral misuse.
Content: No source excerpt is available for this finding.

Chaining Abuse

High

Category: Tool Misuse
Confidence: 96% confidence
Finding: The curl ... | bash pattern creates an immediate code-execution chain from network content to a shell interpreter, removing opportunities for review or integrity validation. In a skill that already requests users to install unrelated agent infrastructure, this significantly amplifies the risk of arbitrary code execution from tampered or substituted content.
Content: Scanner excerpt · Openclaw一键安装.md (reported line 37)May include surrounding context.
md
fi echo "[1/6] 安装 nvm..." curl -fsSL https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.0/install.sh | bash # shellcheck disable=SC1090 . "$NVM_DIR/nvm.sh" }

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script normalizes disclosure of a sensitive gateway credential by extracting it and echoing it during routine verification. In a skill already mismatched to its stated purpose, exposing a live auth token is especially dangerous because anyone with access to the terminal output can potentially connect to or control the local agent gateway.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: A workflow that depends on reusing saved sessions/cookies from the filesystem without declaring that credential access pattern is risky, even if the detailed implementation is external. Hidden reliance on stored authentication material can expose users to unauthorized posting or account misuse if those files are stolen, shared, or invoked unexpectedly.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: A workflow that depends on reusing saved sessions/cookies from the filesystem without declaring that credential access pattern is risky, even if the detailed implementation is external. Hidden reliance on stored authentication material can expose users to unauthorized posting or account misuse if those files are stolen, shared, or invoked unexpectedly.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: A workflow that depends on reusing saved sessions/cookies from the filesystem without declaring that credential access pattern is risky, even if the detailed implementation is external. Hidden reliance on stored authentication material can expose users to unauthorized posting or account misuse if those files are stolen, shared, or invoked unexpectedly.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: A workflow that depends on reusing saved sessions/cookies from the filesystem without declaring that credential access pattern is risky, even if the detailed implementation is external. Hidden reliance on stored authentication material can expose users to unauthorized posting or account misuse if those files are stolen, shared, or invoked unexpectedly.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 89% confidence
Finding: A workflow that depends on reusing saved sessions/cookies from the filesystem without declaring that credential access pattern is risky, even if the detailed implementation is external. Hidden reliance on stored authentication material can expose users to unauthorized posting or account misuse if those files are stolen, shared, or invoked unexpectedly.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: A workflow that depends on reusing saved sessions/cookies from the filesystem without declaring that credential access pattern is risky, even if the detailed implementation is external. Hidden reliance on stored authentication material can expose users to unauthorized posting or account misuse if those files are stolen, shared, or invoked unexpectedly.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: A workflow that depends on reusing saved sessions/cookies from the filesystem without declaring that credential access pattern is risky, even if the detailed implementation is external. Hidden reliance on stored authentication material can expose users to unauthorized posting or account misuse if those files are stolen, shared, or invoked unexpectedly.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.
md
- `scripts/xhs_publish_with_saved_session.js`：使用保存会话直接发布图文

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 141)May include surrounding context.
md
- `scripts/xhs_publish_with_saved_session.js`：使用保存会话直接发布图文

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The documentation explicitly enables direct publishing and automated login flows, including QR/SMS session establishment and immediate posting, but it does not require an explicit user warning or confirmation before taking account-impacting actions. In context, this is dangerous because the skill is designed to operate on a live social media account where a mistaken post, visibility change, or login flow can have immediate reputational and operational consequences.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This code captures the authenticated browser session by exporting cookies plus localStorage and sessionStorage into a JSON file on disk. Those artifacts can contain bearer tokens, session identifiers, and other sensitive state that may allow account takeover or unauthorized reuse of the Xiaohongshu creator session by any process or user with workspace access.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The guide retrieves and prints the gateway authentication token directly to normal terminal output without emphasizing that it is a secret. Displaying credentials in plaintext increases the chance of exposure through shell history, terminal scrollback, screenshots, logs, or shoulder surfing, enabling unauthorized access to the local gateway.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The post-install example instructs users to place the auth token into an environment variable in plaintext for reuse. While common for convenience, this practice increases the risk of accidental leakage via process inspection, shell history, debug output, inherited environments, or copied terminal transcripts.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill references environment-modifying behavior (disable_proxy.js) and relies on local session/state artifacts, but it declares no explicit tool scope or permissions boundaries. That makes privileged behavior non-transparent and increases the risk that the skill is invoked with broader access than users or orchestrators expect.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The manifest description is very broad and can cause the skill to be selected for a wide range of Xiaohongshu-related requests, including sensitive account actions like login, publishing, comment replies, and visibility changes. Overbroad routing increases the chance of accidental invocation of automation that affects a real account without sufficiently narrow intent checks.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill instructs changing proxy-related environment variables via disable_proxy.js without clearly warning that local network settings may be altered. Even if intended to improve platform reliability, silently modifying environment/network behavior can disrupt other tasks, bypass enterprise routing expectations, or create confusing side effects on the host environment.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The instruction states that language should prioritize a conversational style, effectively forcing a specific output style by default. Because the skill does not present this as a user choice or opt-in, it creates a natural-language policy concern around imposed communication style.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The file is entirely authored in Chinese and targets Chinese platforms and account types, but it does not state that the language/locale restriction is optional or region-specific by design. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The entire skill file is written as Chinese-only reply examples and templates, with no indication that users may choose another language or that the skill is intentionally limited to Chinese-language use. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The file defines the persona entirely for 小红书 posting/reply style and sets a default communication mode in Chinese platform-specific voice. This imposes a specific language/locale by default rather than offering the user a choice or making the locale opt-in.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script saves QR-code and page screenshots to predictable workspace paths during login. These images may expose login QR codes, account identifiers, or other transient authentication information that can be used by another local actor to observe or interfere with the authentication flow.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/xhs_publish_with_saved_session.js:42