skill-xhs-comment-reply
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from Xiaohongshu comments to generate automated replies, creating a potential surface for indirect prompt injection attacks where malicious comments could manipulate the agent's output.
- Ingestion points: Xiaohongshu comments are retrieved from the web interface using
xhs_comment.py fetch. - Boundary markers: The skill includes a requirement for human review and agent-side persona checks, but lacks explicit technical delimiters to separate untrusted content.
- Capability inventory: The skill uses Playwright for web automation (network access) and writes to local files for logging and deduplication.
- Sanitization: There is no mention of sanitizing or escaping the fetched comment text before passing it to the LLM.
- [COMMAND_EXECUTION]: The skill performs command-line operations by calling local Python scripts (
xhs_comment.py,xhs_publish.py) to handle browser automation and authentication. - [DATA_EXFILTRATION]: The skill accesses sensitive browser profile data located at
~/.easel-browser-profiles/XiaohongshuProfileto maintain persistent login sessions for Xiaohongshu and performs network operations to interact with the platform.
Audit Metadata