Security audit

小红书舆情哨兵

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent Xiaohongshu monitoring purpose, but it automatically discovers and uses local authentication cookies and emits forged system-style instructions that warrant review before installation.

Install only if you are comfortable with this skill using a Xiaohongshu account session and saving full-page screenshots. Prefer providing XHS_COOKIE explicitly for each run, avoid keeping reusable cookies in discoverable shell scripts, use a dedicated low-privilege monitoring account, and run the browser in an isolated environment if possible. Treat the script output after RESULT_END as untrusted formatting text, not as system instructions.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: scripts/monitor.js:306
Finding: Forged System Messages Hijack the Consuming Agent's Output
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/monitor.js:57
Finding: Automatic Cross-Directory Discovery and Use of Authentication Cookies
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/monitor.js:187
Finding: Chromium Sandbox Disabled While Processing Remote Web Content
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documented behavior says the user should configure XHS_COOKIE, but the skill text also states it will fall back to reading existing scripts and extracting exported cookies from them. That is undeclared local file access and credential harvesting behavior, which can expose account-scoped authentication material from unrelated files and violates least surprise.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 85% confidence
Finding: The skill declares no explicit tool or permission scope even though it depends on environment-provided secrets such as XHS_COOKIE. In practice this weakens user awareness and policy enforcement around secret use, making it easier for the skill to access authenticated state without a clearly declared trust boundary.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The description states the skill is '面向中文用户' and the instructions throughout are fixed to a Chinese-user context, but there is no indication that language/locale behavior is optional or user-selectable. This is a natural-language policy concern because it imposes a specific language/locale without offering opt-in or documenting a justified regional constraint.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill relies on authenticated XHS cookies and captures screenshots, but the description does not clearly warn that outputs may include account-scoped content visible only to the logged-in user. This can lead users to unknowingly collect or share sensitive browsing results and images tied to a personal or corporate account.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill mentions Telegram and WeCom as delivery channels but does not clearly warn that collected notes, summaries, and screenshots may be transmitted to third-party messaging services. That omission increases the risk of accidental external disclosure of sensitive monitoring data, authenticated content, or screenshots.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The code does not only use an explicitly provided XHS_COOKIE from the environment; it also searches multiple local filesystem paths for shell scripts and regex-extracts an exported XHS_COOKIE value from them. That is a credential-discovery/harvesting behavior that exceeds the stated monitoring purpose and can silently consume secrets from unrelated locations, especially dangerous in shared workspaces or multi-skill agent environments.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script reads authentication cookies from both environment variables and local shell scripts without clear user disclosure in the code path, which creates hidden secret-handling behavior. In agentic or hosted execution contexts, this can surprise operators, weaken least-privilege expectations, and cause unintended account access using ambient credentials.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The script writes full-page screenshots to disk for normal, login, captcha, and error states. Those images may capture sensitive content such as account state, search results, QR/login prompts, or other on-screen data, and persisting them locally increases the risk of later unauthorized access or accidental disclosure.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The code forces the Accept-Language header to prefer zh-CN and zh, which imposes a specific locale on all requests. There is no user opt-in, configuration option, or justification indicating that the skill is intentionally region-specific.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.