XHS Research Daily

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:28 AM UTC
• Version: 0.1.0

Overview

The skill is coherent and not deceptive, but it can automate public Xiaohongshu posts from a logged-in account without a per-post approval gate.

Install only if you are comfortable giving this workflow access to a logged-in Xiaohongshu publishing account. Run dry runs first, inspect `post_draft.json` before posting, avoid unattended `--publish` cron jobs until you add your own approval or account controls, and be aware that failure logs may expose per-feed tokens.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill describes and instructs execution of local scripts, file edits, environment-based configuration, and publishing actions, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates an overbroad execution surface where an agent may use shell, file, and environment capabilities implicitly, increasing the risk of unintended command execution, data modification, or misuse of account/session state during automation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This config hard-codes Chinese output elements such as the title prefix "Diffusion日报" and hashtags like "机器学习" and "科研". Because the file provides no user choice or justification for a Chinese-only locale, it creates a natural-language locale policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The operations guide documents a --publish mode and even provides a cron example that enables it, but it does not clearly warn that this performs a live post to Xiaohongshu. In an automation skill, this can lead to accidental public posting, reputational damage, and unintended use of authenticated accounts, especially when copied into unattended scheduled jobs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

When run with publish=True, the pipeline sends generated content to Xiaohongshu immediately via an external API without any approval gate, interactive confirmation, or policy check in this code path. In an automation skill that aggregates third-party content and can repost it, this creates a real risk of unintended publication, accidental disclosure, or posting low-quality/compliance-violating material if the flag is enabled upstream.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Multiple user-facing strings and generated content are fixed in Chinese, and the functions do not expose any language selection or document that the skill is intentionally region-specific. This creates a locale-policy issue because the skill forces a specific language in its natural-language outputs without offering user choice or opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The publish_content method triggers a remote publishing action and routes it through subprocess execution, but the file contains no confirmation prompt, logging, print statement, or explanatory comment/docstring warning the user that content will be published externally. This is a safety-relevant action affecting external state, and the code itself provides no visible disclosure.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/xhs_client.py (reported line 52)May include surrounding context.

python

def _run(self, expr: str, timeout_ms: int = 180000) -> str:
        command = ["mcporter", "call", "--config", self.config_path, "--timeout", str(timeout_ms), expr]
        completed = subprocess.run(command, capture_output=True, text=True)
        if completed.returncode != 0:
            raise RuntimeError(
                f"mcporter call failed: expr={expr}\nstdout={completed.stdout.strip()}\nstderr={completed.stderr.strip()}"

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The pipeline persists fetched search results to search-*.json, and elsewhere writes ranked and processed content to disk. This file contains no visible notice, comment, or docstring informing users that retrieved external content and derived summaries will be stored locally.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The code defines helpers that create parent directories and write JSON or text files to disk, but there is no confirmation prompt, logging/print statement, or explanatory comment/docstring disclosing that filesystem modifications will occur. For a code-file audit under this rule, file writes are safety-relevant operations when they happen without any visible user disclosure in the file.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The client handles a sensitive xsec_token and, on subprocess failure, raises an exception that includes the full generated expression. Because get_feed_detail embeds xsec_token directly into that expression, any error can leak the token into logs, traces, or user-visible error output, exposing session-linked credentials or access tokens.

Content

No source excerpt is available for this finding.