The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill launches a Google Chrome process via subprocess.Popen in scripts/chrome_launcher.py with the --remote-debugging-port flag enabled. It subsequently uses the Chrome DevTools Protocol (CDP) to execute arbitrary JavaScript within the browser context via Runtime.evaluate in scripts/cdp_publish.py to automate form interactions and data extraction.
[DATA_EXPOSURE_AND_EXFILTRATION]: The add_account function in scripts/account_manager.py constructs local file paths for Chrome profiles using the name parameter without adequate sanitization. By providing a crafted account name containing path traversal sequences (e.g., ../../name), a user or agent could potentially create or access directories outside the intended XiaohongshuProfiles directory.
[UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: The scripts/image_downloader.py module facilitates the download of images and videos from arbitrary, user-provided URLs to a local temporary directory. While the downloader uses custom headers to bypass simple hotlink protection, it does not perform deep validation of the downloaded media files, which are later processed by the browser during the upload phase.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its core functionality of ingesting public content.
Ingestion points: The skill extracts note content, search results, comments, and user profiles from Xiaohongshu via scripts/feed_explorer.py and scripts/cdp_publish.py.
Boundary markers: There are no explicit boundary markers or instructions to the agent to treat platform data as untrusted, increasing the risk that adversarial text found in comments or notes could influence agent behavior.
Capability inventory: The skill has significant capabilities, including posting content, commenting, and interacting with other users' posts via an authenticated browser session.
Sanitization: Although the skill implements basic HTML escaping for its internal editor interactions, it processes large amounts of untrusted platform data which is then reflected in the agent's context.

RedBookSkills