# Security Audit Report

## xiaohongshu-mcp

**Security Score:** 25/100  
**Risk Level:** High  
**Audited by:** borye  
**Date:** 2/7/2026, 12:22:33 AM

🔭 Continuously monitored by ClawSecure Watchtower  
**Findings:** 7  
**Critical:** 3  
**Medium:** 3  
**Info:** 1

**Source:** [xiaohongshu-mcp on ClawHub](https://clawhub.ai/borye/xiaohongshu-mcp)  
**SHA-256:** bcebd19add72...

### Overview

xiaohongshu-mcp is a skill for the OpenClaw ecosystem, created by borye. ClawSecure audited this skill through our 3-Layer Audit Protocol covering all 10 OWASP ASI Top 10 categories. This skill received a security score of 25/100, indicating significant security concerns that require attention. The audit identified 7 findings, with issues detected across multiple security layers.

## 3-Layer Audit Protocol

### 🛡 ClawSecure Proprietary Engine
- Missing config.json - agent may not be properly configured  
**Findings:** 1

### 🔒 Advanced Static & Behavioral Analysis
- Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.  
- Pattern detected: import requests  
- Pattern detected: requests.post( +1 more  
**Findings:** 6 (Critical)

### 📦 Supply Chain Security
- No issues detected  
**Findings:** 0 (Pass)

### **CRITICAL Findings**

1. F-001 Pattern detected: requests.post(  
   **File:** scripts/xhs_client.py:61  
2. F-002 Pattern detected: requests.post(  
   **File:** scripts/xhs_client.py:100  
3. F-003 Pattern detected: requests.post(  
   **File:** scripts/xhs_client.py:175

### **MEDIUM Findings**

1. F-001 Pattern detected: import requests  
   **File:** scripts/xhs_client.py:25  
2. F-002 Skill code uses network libraries but doesn't declare network requirement  
3. F-003 Missing config.json - agent may not be properly configured  
   **OWASP ASI:** Identity & Privilege Abuse

### **INFO Findings**

1. F-001 Skill manifest does not include a 'license' field.  
   **File:** SKILL.md

## OWASP ASI Framework Coverage

ASI01 Agent Goal Hijack  
ASI02 Tool Misuse  
ASI03 Identity & Privilege  
ASI04 Agentic Supply Chain  
ASI05 Unexpected Code Execution  
ASI06 Memory & Context  
ASI07 Insecure Inter-Agent Communication  
ASI08 Cascading Failures  
ASI09 Human-Agent Trust Exploitation  
ASI10 Rogue Agents

Categories highlighted were detected in this scan. ClawSecure provides comprehensive coverage across all 10 OWASP ASI Top 10 categories.

## Context-Aware Analysis

This skill requests system-level capabilities which are standard for OpenClaw automation skills. Generic scanners often flag these capabilities as suspicious regardless of context. ClawSecure's Context-Aware Intelligence analyzes capabilities in ecosystem context — we differentiate real threats (malicious code, unauthorized data exfiltration, supply chain vulnerabilities, ReDoS patterns) from normal agent functionality. Our 3-Layer Audit Protocol is purpose-built for the OpenClaw ecosystem.

### Security Recommendations for xiaohongshu-mcp

- **Pin npm dependencies to exact versions:** Unpinned dependencies allow supply chain attacks
- **Add a config.json permissions manifest:** Without it, users have no visibility into what your skill can do before installing.
- **Audit external network connections:** Verify that all outbound connections go to trusted, expected destinations.

## Additional Context

Scanned on February 7, 2026. xiaohongshu-mcp is one of 2,890+ agents audited by ClawSecure from the community-curated awesome-openclaw-skills list and the openclaw/skills repository.