Is xiaohongshu safe?
https://clawhub.ai/heiheimaoya/xiaohongshu
This Xiaohongshu (Little Red Book) social media automation skill poses significant security risks. It includes heavily obfuscated JavaScript with eval()-based code execution (stealth.min.js), starts a persistent unauthenticated HTTP signing server that handles session cookies, and instructs the AI agent to execute shell commands with root-level paths. While the core functionality (content creation and social media posting) is legitimate, the anti-detection tooling, broad permission requirements, and credential handling patterns create a dangerous attack surface that could be exploited for data exfiltration or unauthorized account access.
Category Scores
Findings (10)
CRITICAL Obfuscated JavaScript with extensive eval() usage -45 ▶
stealth.min.js contains heavily obfuscated JavaScript that uses eval() extensively to dynamically execute code strings. The file manipulates browser prototypes, intercepts function calls via Proxy objects, and patches native browser APIs. While this is derived from the known puppeteer-extra-stealth project, the obfuscated nature makes it extremely difficult to verify no malicious payloads are embedded within the eval'd code strings.
CRITICAL Credential handling and local signing server exposure -40 ▶
sign_server.py reads XHS_COOKIE from .env, parses it, injects it into a headless browser, and exposes a signing API on localhost:5006. This creates a persistent service that handles sensitive authentication tokens. The server has no authentication itself - any local process can call it. Combined with browser access, this could be used to silently perform actions on the user's Xiaohongshu account or exfiltrate the session cookies.
HIGH SKILL.md instructs agent to execute shell commands with hardcoded paths -35 ▶
The SKILL.md contains multiple shell command blocks that instruct the agent to activate Python virtual environments, run inline Python code, and interact with external directories. These commands operate at /root/ paths suggesting root-level access expectations. The agent is directed to execute python -c with multiline inline code, which is a direct code execution vector.
HIGH Persistent HTTP server and browser automation -25 ▶
The skill includes sign_server.py which starts a persistent aiohttp web server on port 5006 that stays running indefinitely (while True: await asyncio.sleep(3600)). It also launches headless Chromium instances via Playwright. This gives the skill persistent network and browser capabilities that survive individual agent interactions.
HIGH Anti-detection tooling normalizes evasion techniques -40 ▶
The inclusion of stealth.min.js (puppeteer-extra-stealth evasions) is specifically designed to make automated browsers appear as real users, evading bot detection. While this serves the stated purpose of RPA-based posting, it normalizes anti-detection practices and could be leveraged to perform unauthorized scraping, account manipulation, or platform abuse at scale.
HIGH AWS credentials accessed during installation -15 ▶
Filesystem monitoring shows /home/oc-exec/.aws/credentials was opened and accessed during the skill installation process. While this may be incidental to the installation framework rather than the skill itself, it indicates the installation context has access to sensitive cloud credentials.
MEDIUM Skill requests excessive permissions beyond stated purpose -20 ▶
While described as a 'content creation and publishing' skill, it requires shell access, Python virtual environment activation, browser automation, cookie management, file system access, and network server capabilities. This permission scope far exceeds what a content creation tool should need.
MEDIUM Cookie and credential file storage in known paths -15 ▶
The skill stores and reads authentication cookies from predictable paths (social-auto-upload/cookies/xhs_account.json, .env). Any other skill or process with filesystem access could read these credentials. The skill also documents the .env file in its directory structure.
LOW Multiple temp files and lock files created during install -10 ▶
Installation created multiple jiti cache files in /tmp/ and a lock file at /tmp/openclaw-1000/. While likely benign (part of the installation framework), these filesystem changes outside the skill directory warrant noting.
INFO Canary files intact 0 ▶
No honeypot files (.env, SSH keys, AWS credentials canaries) were accessed or modified by the skill, indicating no active credential harvesting during installation.