xiaohongshu-mcp-integration
Fail
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill directs users to download binary files from an untrusted GitHub repository (github.com/xpzouying/xiaohongshu-mcp/releases) for various platforms.
- [REMOTE_CODE_EXECUTION]: The provided installation steps involve making these downloaded binaries executable and running them, which executes third-party code on the host system.
- [COMMAND_EXECUTION]: The skill performs shell-level command execution to run the MCP server and login tools.
- [DYNAMIC_EXECUTION]: During the first execution, the tool downloads a headless browser (~150MB) to the local machine at runtime.
- [DATA_EXFILTRATION]: Tools such as xhs_create_image_note and xhs_create_video_note take absolute file paths as arguments. An agent could potentially be manipulated to read and upload sensitive system files to the Xiaohongshu platform.
- [INDIRECT_PROMPT_INJECTION]: The skill consumes untrusted data from Xiaohongshu feeds and search results. Ingestion points: xhs_search and xhs_get_recommend_feeds. Boundary markers: Not present in instructions. Capability inventory: Network access to publish content and local file system access. Sanitization: No validation or sanitization of external content is described.
Recommendations
- AI detected serious security threats
Audit Metadata