T05 · Unauthorized Access and Privilege Escalation
Error
- Location
CLAUDE.md:152- Finding
Project Instructions Direct the Agent to Private Credential Memory
- Content
View full analysis
- Remediation
View remediation
Security audit
Huo15 Xiaohongshu
Security checks for vulnerabilities and agentic risk
Overview
The skill is mainly a Xiaohongshu content assistant, but it asks for sensitive account/browser access and contains unsafe credential and browser-session handling that needs review before use.
Review this skill carefully before installing. Use it only if you are comfortable giving it access to your own Xiaohongshu cookie or authenticated browser profile, avoid storing or sharing xsec_token values, do not follow the CLAUDE.md publishing-credential path, and prefer an isolated environment with pinned dependencies. The content-writing features are coherent, but the browser bridge and credential handling should be tightened before routine use.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/browser_bridge.py:585- Finding
Search Input Is Injected into JavaScript Executed in an Authenticated Browser
- Content
View full analysis
4 && text.length < 200 && !seen[href]) { seen[href] = true; var parent = a.closest('section, div[class*=note], div[class*=card]'); var likes = ''; var author = ''; if (parent) { var likeEl = parent.querySelector('[class*=like], [class*=count]'); if (likeEl) likes = likeEl.innerText.trim(); var authorEl = parent.querySelector('[class*=author], [class*=name], [class*=nickname]'); if (authorEl) author = authorEl.innerText.trim(); } notes.push({title: text.substring(0, 100), url: href, likes: likes, author: author}); } } return {notes: notes.slice(0, 20), keyword: '""" + keyword + """'}; })()) """) ``` The resulting expression is passed to Chrome DevTools Protocol: ```python ws.send(json.dumps({ "id": 1, "method": "Runtime.evaluate", "params": {"expres ...[truncated 2206 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/browser_bridge.py:317- Finding
Persistent Authenticated Chrome Is Launched with an Overly Permissive CDP Configuration
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/track_post.py:60- Finding
Reusable Xiaohongshu Access Tokens Are Persisted in Plaintext
- Content
View full analysis
None: p = Path(os.path.expanduser(path)) p.parent.mkdir(parents=True, exist_ok=True) with p.open("a", encoding="utf-8") as f: f.write(json.dumps(entry, ensure_ascii=False) + "\n") def _rewrite_jsonl(path: str, entries: List[Dict[str, Any]]) -> None: p = Path(os.path.expanduser(path)) p.parent.mkdir(parents=True, exist_ok=True) with p.open("w", encoding="utf-8") as f: for e in entries: f.write(json.dumps(e, ensure_ascii=False) + "\n") def cmd_register(args: argparse.Namespace) -> int: posts = _read_jsonl(args.log) found = False for p in posts: if p.get("post_uid") == args.uid: p["note_id"] = args.note_id p["xsec_token"] = args.xsec_token or "" p["published_at"] = dt.datetime.now().isoformat(timespec="seconds") found = True break if not found: print(f"❌ 没找到 post_uid={args.uid}，请先用 publish_helper.py 准备并 --log", file=sys.stderr) return 1 _rewrite_jsonl(args.log, posts) print(f"✓ 已关联 note_id={args.note_id}") return 0 ``` The stored token is subsequently reused: ```python rc = _do_snapshot( client, p["note_id"], p.get("xsec_token", ""), args.snapshots ) ``` ### Technical Analysis The `xsec_token` value is written directly into `~/.xiaohongshu/posts.jsonl`. The code uses normal file creation and does not explicitly set owner-only permissions, encrypt the value, redact it from records, or remove it after use. Although an `xsec_token` is not equivalent to the full `XHS_COOKIE`, it is a reusable request parameter associa ...[truncated 1162 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
README.md:16- Finding
Runtime Dependencies Are Unpinned and the Browser Dependency Is Incompletely Declared
- Content
View full analysis
dict: """在匹配的标签页中执行 JavaScript 并返回结果。含风控检测 + 拟人滚动。""" import websocket ``` The project changelog identifies the intended package as `websocket-client`, but it is absent from the primary dependency declaration and installation instructions. ### Technical Analysis All documented package installations resolve the latest available package versions at installation time. There is no lockfile, exact version constraint, integrity hash, or reviewed package index. This makes installations non-reproducible and allows future dependency releases to alter the effective code executed by the Skill. The browser bridge imports the module named `websocket`, while the intended distribution is `websocket-client`. Because the package is not declared in the normal dependency list, users may guess the package name and install a similarly named or unintended package. This creates a dependency-confusion and package-selection risk. No evidence was found that the currently named packages are themselves malicious. The vulnerability is the unsafe and incomplete dependency-management process. ### Attack Path 1. A user follows the README and runs unpinned `pip install` commands. 2. The resolver downloads whatever ...[truncated 943 chars]- Remediation
View remediation
Vulnerability Patterns
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (194)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
Structured extraction of notes, user profiles, search previews, and media metadata from raw HTML demonstrates a generalized data-extraction pipeline. That creates clear dual-use potential for harvesting and repurposing platform data beyond the declared writing-assistance function.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
Structured extraction of notes, user profiles, search previews, and media metadata from raw HTML demonstrates a generalized data-extraction pipeline. That creates clear dual-use potential for harvesting and repurposing platform data beyond the declared writing-assistance function.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
Structured extraction of notes, user profiles, search previews, and media metadata from raw HTML demonstrates a generalized data-extraction pipeline. That creates clear dual-use potential for harvesting and repurposing platform data beyond the declared writing-assistance function.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
Structured extraction of notes, user profiles, search previews, and media metadata from raw HTML demonstrates a generalized data-extraction pipeline. That creates clear dual-use potential for harvesting and repurposing platform data beyond the declared writing-assistance function.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Structured extraction of notes, user profiles, search previews, and media metadata from raw HTML demonstrates a generalized data-extraction pipeline. That creates clear dual-use potential for harvesting and repurposing platform data beyond the declared writing-assistance function.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
Structured extraction of notes, user profiles, search previews, and media metadata from raw HTML demonstrates a generalized data-extraction pipeline. That creates clear dual-use potential for harvesting and repurposing platform data beyond the declared writing-assistance function.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Structured extraction of notes, user profiles, search previews, and media metadata from raw HTML demonstrates a generalized data-extraction pipeline. That creates clear dual-use potential for harvesting and repurposing platform data beyond the declared writing-assistance function.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
Structured extraction of notes, user profiles, search previews, and media metadata from raw HTML demonstrates a generalized data-extraction pipeline. That creates clear dual-use potential for harvesting and repurposing platform data beyond the declared writing-assistance function.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Structured extraction of notes, user profiles, search previews, and media metadata from raw HTML demonstrates a generalized data-extraction pipeline. That creates clear dual-use potential for harvesting and repurposing platform data beyond the declared writing-assistance function.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Structured extraction of notes, user profiles, search previews, and media metadata from raw HTML demonstrates a generalized data-extraction pipeline. That creates clear dual-use potential for harvesting and repurposing platform data beyond the declared writing-assistance function.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Structured extraction of notes, user profiles, search previews, and media metadata from raw HTML demonstrates a generalized data-extraction pipeline. That creates clear dual-use potential for harvesting and repurposing platform data beyond the declared writing-assistance function.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
Structured extraction of notes, user profiles, search previews, and media metadata from raw HTML demonstrates a generalized data-extraction pipeline. That creates clear dual-use potential for harvesting and repurposing platform data beyond the declared writing-assistance function.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python3 scripts/assistant.py preset allen
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python3 scripts/assistant.py preset allen
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python3 scripts/assistant.py preset allen
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python3 scripts/assistant.py preset allen
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python3 scripts/assistant.py preset allen
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python3 scripts/assistant.py preset allen
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python3 scripts/assistant.py preset allen
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python3 scripts/assistant.py preset allen
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python3 scripts/assistant.py preset allen
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python3 scripts/assistant.py preset allen
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python3 scripts/assistant.py preset allen
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python3 scripts/assistant.py preset allen
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python3 scripts/assistant.py preset allen