Security Audit Report

xiaohongshu-mcp

Security Score: 25/100
Risk Level: High
Audited by: borye
Date: 2/7/2026, 12:22:33 AM

🔭 Continuously monitored by ClawSecure Watchtower
Findings: 7
Critical: 3
Medium: 3
Info: 1

Source: xiaohongshu-mcp on ClawHub
SHA-256: bcebd19add72...

Overview

xiaohongshu-mcp is a skill for the OpenClaw ecosystem, created by borye. ClawSecure audited this skill through our 3-Layer Audit Protocol covering all 10 OWASP ASI Top 10 categories. This skill received a security score of 25/100, indicating significant security concerns that require attention. The audit identified 7 findings, with issues detected across multiple security layers.

3-Layer Audit Protocol

🛡 ClawSecure Proprietary Engine

  • Missing config.json - agent may not be properly configured
    Findings: 1

🔒 Advanced Static & Behavioral Analysis

  • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.
  • Pattern detected: import requests
  • Pattern detected: requests.post( +1 more
    Findings: 6 (Critical)

📦 Supply Chain Security

  • No issues detected
    Findings: 0 (Pass)

CRITICAL Findings

  1. F-001 Pattern detected: requests.post(
    File: scripts/xhs_client.py:61
  2. F-002 Pattern detected: requests.post(
    File: scripts/xhs_client.py:100
  3. F-003 Pattern detected: requests.post(
    File: scripts/xhs_client.py:175

MEDIUM Findings

  1. F-001 Pattern detected: import requests
    File: scripts/xhs_client.py:25
  2. F-002 Skill code uses network libraries but doesn't declare network requirement
  3. F-003 Missing config.json - agent may not be properly configured
    OWASP ASI: Identity & Privilege Abuse

INFO Findings

  1. F-001 Skill manifest does not include a 'license' field.
    File: SKILL.md

OWASP ASI Framework Coverage

ASI01 Agent Goal Hijack
ASI02 Tool Misuse
ASI03 Identity & Privilege
ASI04 Agentic Supply Chain
ASI05 Unexpected Code Execution
ASI06 Memory & Context
ASI07 Insecure Inter-Agent Communication
ASI08 Cascading Failures
ASI09 Human-Agent Trust Exploitation
ASI10 Rogue Agents

Categories highlighted were detected in this scan. ClawSecure provides comprehensive coverage across all 10 OWASP ASI Top 10 categories.

Context-Aware Analysis

This skill requests system-level capabilities which are standard for OpenClaw automation skills. Generic scanners often flag these capabilities as suspicious regardless of context. ClawSecure's Context-Aware Intelligence analyzes capabilities in ecosystem context — we differentiate real threats (malicious code, unauthorized data exfiltration, supply chain vulnerabilities, ReDoS patterns) from normal agent functionality. Our 3-Layer Audit Protocol is purpose-built for the OpenClaw ecosystem.

Security Recommendations for xiaohongshu-mcp

  • Pin npm dependencies to exact versions: Unpinned dependencies allow supply chain attacks
  • Add a config.json permissions manifest: Without it, users have no visibility into what your skill can do before installing.
  • Audit external network connections: Verify that all outbound connections go to trusted, expected destinations.

Additional Context

Scanned on February 7, 2026. xiaohongshu-mcp is one of 2,890+ agents audited by ClawSecure from the community-curated awesome-openclaw-skills list and the openclaw/skills repository.