xhs-smart-publisher

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). High risk — the skill intentionally sends page screenshots and status messages to a hard‑coded Telegram group and then acts on Telegram replies to publish/save content, which constitutes deliberate external data exfiltration and a remote‑control channel; reuse of a local browser profile/CDP also risks leaking authentication tokens.