小红书定制化创作

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:34 AM UTC
• Version: 1.0.0

Overview

The skill largely matches its Xiaohongshu publishing purpose, but it also directs the agent to record published content in Feishu without clear consent, destination, or data limits.

Use this only when you intend the agent to publish live content from your logged-in Xiaohongshu account. Before allowing publication, confirm the account, title, body, images, and topics. Do not allow the Feishu logging step unless the destination workspace, repository, copied fields, retention, and audience are explicit and acceptable.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

other

Warning

• Location: SKILL.md:58
• Finding: Undisclosed Third-Party Data Replication to Feishu<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:58-61` **Vulnerability Type**: Unnecessary third-party data replication **Risk Level**: Medium ### Vulnerable Instruction The following is an English rendering of the complete affected source segment: ```markdown ### Step 5: Confirm Success 1. Wait for the page to display "Published successfully" 2. Record it in Feishu's "Published Content Repository" ``` ### Technical Analysis The skill's declared purpose is to publish user-approved content to Xiaohongshu. However, the final step also directs the agent to create a record in an unspecified Feishu repository. This additional external write is not disclosed in the skill overview, prerequisites, README workflow, tool description, or output contract. The instruction does not: - Identify the authorized Feishu workspace or repository. - Define which content or metadata may be copied. - Require explicit user consent before the external write. - Establish data-minimization or access-control requirements. - Explain how failures, duplicate records, or incorrect destinations should be handled. If the agent has access to an authenticated Feishu session, it may consequently replicate user content or publication metadata to a third-party workspace that the user did not intend to use. ### Attack Path 1. A user invokes the skill and requests publication on Xiaohongshu. 2. The agent uses the existing authenticated browser session to publish the supplied content. 3. After detecting a successful publication, the agent follows Step 5 of `SKILL.md`. 4. The agent accesses Feishu using any available authenticated session. 5. The agent writes publication content or metadata into the unspecified "Published Content Repository" without obtaining separate confirmation. 6. The information may be exposed to members of an unintended Feishu workspace or retained outside the user's expected publication scope. ### Impact Assessment The issue does not directly grant o ...[truncated 631 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the Feishu-recording step if it is not essential to Xiaohongshu publication. 2. If Feishu integration is required, declare it explicitly in the skill description, README, prerequisites, workflow, and output contract. 3. Require explicit, per-operation user confirmation before writing any information to Feishu. 4. Identify the exact authorized Feishu workspace, repository, and account context before performing the write. 5. Define an allowlist of fields that may be transferred and apply data minimization; do not copy full post content unless specifically requested. 6. Verify that the active Feishu account and destination belong to the intended user or organization. 7. Present the proposed destination and data fields to the user before submission. 8. Record whether the external write succeeded without exposing sensitive content in logs. 9. Fail safely when the destination is ambiguous, authorization is unavailable, or consent has not been obtained. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger phrase “发布小红书” is broad enough to match ordinary user requests about publishing to Xiaohongshu, which can cause the skill to activate in situations where the user did not intend this specific fixed workflow. Because the skill performs real publication steps, ambiguous triggering increases the risk of unintended account actions or accidental posting.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The README describes a workflow that culminates in publishing content but does not warn users that the skill can perform a real external account action affecting their Xiaohongshu account and posted content. In this context, the lack of warning is more dangerous because the skill is explicitly optimized for successful posting and uses a fixed process, making accidental or uninformed publication more likely.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The skill is entirely specified in Chinese and tightly scoped to a Chinese platform workflow, but it does not state that language choice is optional or user-driven. Under the policy, forcing a specific language or locale without opt-in can be a natural-language policy violation unless explicitly justified.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill automates a live publishing action on the user's logged-in Xiaohongshu account, but it does not clearly warn the user that invoking the skill can cause an immediate real-world post. That creates a risk of unintended publication, reputational harm, or accidental posting of unreviewed content because the user may interpret it as drafting help rather than an account-affecting action.

Missing User Warnings

Low

• Confidence: 87% confidence
• Finding: The instruction to record published content into Feishu introduces a secondary data transfer to another service without any notice about privacy, retention, or what fields are copied. This can expose content, links, campaign data, or account-related metadata to a broader audience than the user expects, especially in workplace Feishu environments.

Static analysis

No suspicious patterns detected.