hongshu-note-parser

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:07 AM UTC
• Version: 1.0.1

Overview

The skill mostly matches its Xiaohongshu report purpose, but its report generator can be driven to read local files or fetch arbitrary URLs from an analysis JSON, so it needs review before use.

Install only if you are comfortable running it with constrained file and network access. Use analysis JSON files you created and trust, do not feed arbitrary third-party JSON into --generate-html, and review generated HTML before sharing it because embedded data can include fetched content or local file bytes. Maintainers should enforce allowed image directories, approved HTTPS hosts, redirect checks, MIME/signature validation, and response size limits.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/parse.py:119

Finding

Arbitrary Local File Disclosure Through Report Image References

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/parse.py:142

Finding

Server-Side Request Forgery Through Analysis JSON Image URLs

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/parse.py:198

Finding

Short-Link Validation Uses an Unsafe Hostname Substring Check

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · skill.yaml (reported line 40)May include surrounding context.

yaml

- "Does not access arbitrary URLs (only user-provided Xiaohongshu links and image CDN)"
  - "Does not send data to third-party services or external LLM APIs"
  - "Does not modify or delete existing files"
  - "Does not collect environment variables or system information"

triggers:
  - hongshu-note-parser

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill describes network access plus local file read/write behavior, but it does not declare an explicit machine-readable tool scope such as permissions or allowed-tools. That creates a policy gap: an agent/runtime may permit broader operations than users expect, and reviewers cannot reliably enforce least privilege from the metadata alone. The risk is elevated here because the workflow combines fetching user-supplied URLs, downloading remote images, and reading local files for analysis/HTML generation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest-facing fields and workflow instructions are written as if the skill operates in Chinese by default, and the required output schema hard-codes Chinese labels and platform strings. Because there is no explicit user opt-in or language-selection mechanism, this creates a natural-language locale policy issue under the rule for forced language without user choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest includes Chinese-only invocation phrases and presents the skill description in Chinese alongside English, but does not state that the user may choose their preferred language or that the skill is limited to Chinese-language operation for a documented regional reason. This can constitute a language/locale policy issue because the skill appears tailored to a specific language without explicit opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown file documents behavior that fetches note content, downloads images, and writes analysis/HTML output, but it does not include a clear warning that running the skill will store retrieved content and generated artifacts on disk. For markdown files, SQP-2 applies when the description omits warnings about behaviors that may affect user data or system state.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This JSON contains extensive natural-language content exclusively in Chinese, including titles, summaries, and guidance text, but does not indicate that Chinese is an optional or user-selected language. Under the language/locale policy rule, forcing a specific language without opt-in can be a policy concern unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The HTML declares lang="zh-CN", and the page content is entirely Chinese with no visible mechanism for user language selection or opt-in. Under the stated policy, forcing a specific language/locale without user choice can be a natural-language policy violation unless clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The HTML root declares lang="zh-CN", and the page content is entirely presented in Chinese, with no visible indication that users can select another language or that the skill is intentionally limited to a Chinese-only audience. This creates a natural-language locale constraint that may conflict with a policy requiring language choice or explicit justification.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

Manifest 将技能定位为抓取小红书笔记内容并输出交互式 HTML 报告，且明确“分析由调用方 AI 完成”。该示例文件却把产出显著包装为“品牌解析”，并在正文中大量提供营销复用、流量策略和品牌建议，超出了单纯笔记内容解析的直观范围。

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

页脚文案直接把技能定义为“丢一条小红书笔记链接，还你一份结构化品牌分析”，这与 manifest 中强调的笔记内容抓取、图片/标签/互动数据提取及通用 HTML 报告存在明显意图层面的偏移。这里不是简单信息缺失，而是将技能目标主动表述为更窄且不同的“品牌分析”。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This code hard-codes the generated HTML document language as zh-CN, which imposes a specific locale on all output regardless of user preference. The file does not offer a language choice or explain why Chinese-only output is required, so it matches the language/locale policy concern.

Content

No source excerpt is available for this finding.