Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed Xiaohongshu posting workflow that relies on browser actions and repeated user confirmations before anything is published.
Before installing, confirm you are comfortable with the agent operating a browser session for Xiaohongshu posting and optionally storing materials in Feishu. Review generated content, source rights, and previews carefully, and only approve the final publish action when the account, title, card style, and content are correct.
The invocation examples are very broad (e.g. '发小红书', '帮我发小红书文案') and do not define clear activation boundaries, which can cause the skill to trigger in situations the user did not intend. In a skill that performs browser-based publishing actions, overly broad triggering increases the risk of unintended posting, misuse in adjacent contexts, or execution on insufficiently validated user input.
The README describes collecting materials from across the web, optionally storing them in Feishu, and publishing content through a browser workflow, but it does not clearly disclose privacy, copyright, credential, or data-handling risks. Because this skill handles externally sourced content and performs account-level publishing, missing warnings and safeguards can lead to leakage of sensitive material, unauthorized reuse of content, or accidental exposure of user/account data.
All user-facing documentation in this file is in Chinese, and there is no indication that the user can choose another language or that the skill is intentionally restricted to a Chinese-speaking audience. This can be a language policy issue when skills are expected to avoid forcing a specific language without opt-in.
No suspicious patterns detected.
