xiaohongshu-comment
Pass
Audited by Gen Agent Trust Hub on Jun 26, 2026
Risk Level: SAFEPROMPT_INJECTIONDATA_EXFILTRATIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted comment data from Xiaohongshu to perform AI-driven summarization.
- Ingestion points: Comments are retrieved from the Redfox API in
scripts/xiaohongshu_comment_search.pyand processed by the agent. - Boundary markers: The skill instructions do not specify explicit delimiters or 'ignore embedded instructions' warnings for the summarization task.
- Capability inventory: The skill can perform network requests and write files to the local system.
- Sanitization: While HTML escaping is used for the visual report, the natural language content is not sanitized against instructional injection.
- [DATA_EXFILTRATION]: The skill transmits the note ID and API key to
redfox.hkto retrieve comment data. This behavior is consistent with the skill's stated purpose and the author's identified infrastructure. - [COMMAND_EXECUTION]: The skill executes local Python scripts (
xiaohongshu_comment_search.py,backfill_html.py) and uses theopencommand to display the generated HTML reports to the user.
Audit Metadata