xiaohongshu
Fail
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: HIGHCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructions require the user to manually clone a repository from an untrusted source (github.com/peanut996/xiaohongshu-mcp) and execute its scripts, specifically './xiaohongshu-login' and './start.sh', which grants the external code execution capabilities on the host system.
- [EXTERNAL_DOWNLOADS]: The skill relies on external code hosted in a non-verified repository belonging to a third-party user, creating a supply chain risk.
- [CREDENTIALS_UNSAFE]: The documentation specifies that successful login will save session cookies to a local file ('cookies/cookies.json'). Storing sensitive authentication data in plain text locally increases the risk of credential theft by other processes or users on the system.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external, user-generated content from Xiaohongshu posts. 1. Ingestion points: 'scripts/xhs_search.py' fetches data from a local API which retrieves content from the web. 2. Boundary markers: Absent; the data is interpolated directly into the agent context. 3. Capability inventory: 'scripts/xhs_search.py' outputs the retrieved content to the terminal for agent processing. 4. Sanitization: Absent; content is processed without filtering for potential malicious instructions.
Recommendations
- AI detected serious security threats
Audit Metadata