Security audit

Xiaohongshu Demand Discovery

Security checks across malware telemetry and agentic risk

Overview

The skill’s data-collection purpose is mostly coherent, but it also exposes logged-in Xiaohongshu account actions such as commenting, liking, collecting, and publishing, so it belongs in Review before installation.

Install only if you are comfortable giving the skill access to a logged-in Xiaohongshu session. Prefer the read-only demand-discovery/search/feed commands, avoid enabling auto-publish or account-interaction commands unless you explicitly intend to post or mutate the account, review generated datasets before sharing, and consider deleting local cookies/output files when finished.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The module-level documentation states it follows a manual-confirmation safety model, but both publish_image and publish_video allow automatic submission when auto_publish=True, and the code directly clicks the publish button with no enforced human checkpoint. This mismatch can cause operators or downstream agents to trust the module as approval-gated when it can actually perform irreversible account actions autonomously.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The usage guide documents collection commands and output paths, but it does not give a clear upfront warning that executing these commands will write scraped notes, comments, summaries, and reports to disk. In a data-collection skill, that omission can lead users to unintentionally retain potentially sensitive or regulated data locally, increasing privacy, compliance, and data-handling risk.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The code performs live comment submission immediately after navigating and typing, with no explicit user confirmation, preview, or safety interlock before posting. In an automation skill that controls a logged-in social media account, this increases the risk of accidental or unauthorized posting, especially if upstream inputs are malformed, prompt-injected, or triggered unintentionally.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The collector stores scraped post content and public comments into local JSONL files without any explicit consent notice, retention control, or minimization beyond hashing comment authors. Even though the data is public, persistent local storage increases privacy and compliance risk because operators may accumulate searchable datasets containing user-generated content and metadata without realizing the sensitivity or downstream obligations.

Missing User Warnings

Low

Confidence: 89% confidence
Finding: The code writes the login QR code image to a predictable on-disk location inside the skill directory without explicit user consent, cleanup, or any notice that the artifact will persist. While the QR itself is short-lived, saving authentication artifacts to disk can expose sensitive login state to other local users, later processes, backups, or logs in shared/multi-tenant environments.

Unpinned Dependencies

Low

Category: Supply Chain
Content: playwright>=1.40.0 markdown>=3.5 pytest>=7.0 pytest-mock>=3.0
Confidence: 93% confidence
Finding: playwright>=1.40.0

Unpinned Dependencies

Low

Category: Supply Chain
Content: playwright>=1.40.0 markdown>=3.5 pytest>=7.0 pytest-mock>=3.0
Confidence: 96% confidence
Finding: markdown>=3.5

Unpinned Dependencies

Low

Category: Supply Chain
Content: playwright>=1.40.0 markdown>=3.5 pytest>=7.0 pytest-mock>=3.0
Confidence: 90% confidence
Finding: pytest>=7.0

Unpinned Dependencies

Low

Category: Supply Chain
Content: playwright>=1.40.0 markdown>=3.5 pytest>=7.0 pytest-mock>=3.0
Confidence: 89% confidence
Finding: pytest-mock>=3.0

Known Vulnerable Dependency: markdown — 2 advisory(ies): CVE-2025-69534 (Python-Markdown has an Uncaught Exception); CVE-2025-69534 (Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like se)

High

Category: Supply Chain
Confidence: 78% confidence
Finding: markdown

Known Vulnerable Dependency: pytest — 1 advisory(ies): CVE-2025-71176 (pytest has vulnerable tmpdir handling)

Low

Category: Supply Chain
Confidence: 64% confidence
Finding: pytest

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.