xiaohongshu

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill requires extracting and reusing parameters like "xsec_token" (a secret-like token) from search/browse results and passing them into subsequent tool calls, which forces the agent to handle and emit secret values verbatim.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skills call MCP tools like search_feeds and get_feed_detail to fetch and analyze public user-generated Xiaohongshu notes and comments (see skills/xhs-content-plan/SKILL.md and skills/xhs-explore/SKILL.md), so the agent ingests untrusted third‑party content that can influence its analysis and actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The setup-xhs-mcp skill instructs a runtime download and execution flow (wget https://raw.githubusercontent.com/xpzouying/xiaohongshu-mcp/main/docker/docker-compose.yml followed by docker compose up -d), which fetches remote configuration and causes execution of remote container images—remote content that is required for the skill and can execute code.