Skill Trust Decision
xhs-note-analyst (账号诊断)
Core helper wc3-code.mjs is fully obfuscated, undeclared in SKILL.md, and can exfiltrate prompts to an arbitrary configurable LLM endpoint; skill-card.md acknowledges this risk but SKILL.md does not.
Most direct threat evidence
High Obfuscation
Obfuscated wc3-code.mjs with undeclared data exfiltration path wc3-code.mjs is the skill's LLM pipeline agent (invoked by skill.mjs via spawn). The entire file uses string-encoding/obfuscation with a self-decoding pattern, making static analysis and audit impossible. It reads WC3_LLM_ENDPOINT from the environment (defaulting to local pipeline but configurable to any URL) and sends full prompts (containing note titles, creator data, benchmarks, and analysis context) to that endpoint. SKILL.md makes no mention of this file or its role. skill-card.md acknowledges the obfuscation risk but SKILL.md does not.
wc3-code.mjs:1 Why this conclusion was reached
2/4 dimensions flagged Block
Declared vs actual capability
1 undeclared or violating capabilities were inferred.
Review
Hidden execution and egress
8 lower-risk artifacts were extracted and still need context.
Block
Attack chain and severe findings
The report includes 0 attack-chain steps and 1 severe findings.
Review
Dependencies and supply chain hygiene
Dependency information is incomplete, so supply-chain confidence stays limited.
What drove the risk score up
Obfuscated core helper undeclared in SKILL.md +20
wc3-code.mjs is entirely string-encoded/obfuscated and referenced by skill.mjs as the LLM pipeline agent, but SKILL.md does not mention it or its data-sending role
Configurable external LLM endpoint with no allowlist +15
WC3_LLM_ENDPOINT defaults to local pipeline but can be set to any URL via env var; prompts containing note titles and creator data are sent there
SKILL.md vs skill-card.md disclosure gap +10
skill-card.md (same package) lists obfuscation as a known risk, but SKILL.md — the primary operational doc — makes no mention of it
Legitimate architecture with webclaw3 dependency +-5
Browser relay at localhost:3459 and Python subprocess for xlsx parsing are declared and reasonable for the use case
No hard malicious indicators +-10
No credential harvesting, no network exfiltration, no reverse shell, no base64|bash chains. Actual behavior matches stated purpose.
Most important evidence
High Obfuscation
Obfuscated wc3-code.mjs with undeclared data exfiltration path
wc3-code.mjs is the skill's LLM pipeline agent (invoked by skill.mjs via spawn). The entire file uses string-encoding/obfuscation with a self-decoding pattern, making static analysis and audit impossible. It reads WC3_LLM_ENDPOINT from the environment (defaulting to local pipeline but configurable to any URL) and sends full prompts (containing note titles, creator data, benchmarks, and analysis context) to that endpoint. SKILL.md makes no mention of this file or its role. skill-card.md acknowledges the obfuscation risk but SKILL.md does not.
wc3-code.mjs:1 Replace wc3-code.mjs with clear, auditable code. Declare the LLM endpoint in SKILL.md and add environment-variable allowlisting.
Medium Doc Mismatch
SKILL.md omits the obfuscated helper and LLM data flow
SKILL.md describes the analysis workflow as reading Excel, searching, and generating HTML, but never mentions that prompts are sent to an LLM endpoint via a separate helper script. The wc3-code.mjs file is the actual mechanism for keyword extraction, benchmark selection, and action generation, yet it is invisible in SKILL.md. skill-card.md (in the same package) does flag this but SKILL.md — the primary user-facing operational doc — is silent.
SKILL.md:1 Add a 'Architecture' section to SKILL.md naming wc3-code.mjs, describing that prompts with note data are sent to the webclaw3 pipeline LLM, and document what data fields are included.
Medium Sensitive Access
Creator account nickname and performance data sent to external LLM
The skill extracts the user's creator account nickname from the Xiaohongshu creator dashboard page (skill.mjs:401-402) and sends it alongside all note titles, metrics, and analysis context to the LLM endpoint via wc3-code.mjs. This is business-sensitive personal account data. While sent to the local webclaw3 pipeline by default, the endpoint is user-configurable via WC3_LLM_ENDPOINT with no allowlist guard.
skill.mjs:401 Document what creator account data is sent to the LLM. Consider hash/anonymize nickname before inclusion in prompts if the pipeline endpoint could be reconfigured.
Low Doc Mismatch
SKILL.md claims '不需要任何第三方 API key' but depends on webclaw3 which may use API keys
SKILL.md emphasizes no third-party API key is needed, but webclaw3's local pipeline service (running at :3460) is powered by an LLM backend which may consume API credentials. The skill itself doesn't provide keys, but the dependency infrastructure may.
SKILL.md:35 Clarify that webclaw3's pipeline requires its own API key configuration and that the local pipeline must be set up separately.
Declared capability vs actual capability
Filesystem Pass
Declared WRITE
→ Inferred WRITE
skill.mjs:905-910 writes report HTML, res.json, data.md to user-specified paths Network Pass
Declared READ
→ Inferred READ
skill.mjs:16 relayCall POSTs to http://127.0.0.1:3459 (webclaw3 browser relay); search URLs to xiaohongshu.com Shell Pass
Declared WRITE
→ Inferred WRITE
skill.mjs:380 spawn('python3', ...) for xlsx parsing; skill.mjs:113 spawn('node', [WC3_CODE]) for LLM subsessions — both documented Skill Invoke Pass
Declared NONE
→ Inferred NONE
No dynamic skill invocation detected Browser Pass
Declared READ
→ Inferred READ
skill.mjs:24 relayCall wraps Extension Relay HTTP API at :3459; all browser ops go through it Environment Block
Declared NONE
→ Inferred READ
wc3-code.mjs reads process.env.WC3_LLM_ENDPOINT — undeclared env access in an obfuscated helper Clipboard Pass
Declared NONE
→ Inferred NONE
No clipboard access detected Database Pass
Declared NONE
→ Inferred NONE
No database access detected Suspicious artifacts and egress
Medium External URL
https://clawhub.ai/fatmind/skills/webclaw3-browser-automation** README.md:25
Medium External URL
https://clawhub.ai/fatmind/skills/webclaw3-browser-automation SKILL.md:19
Medium External URL
https://clawhub.ai/user/fatmind skill-card.md:9
Medium External URL
https://clawhub.ai/fatmind/skills/xhs-note-analyst skill-card.md:39
Medium External URL
http://127.0.0.1:3459 skill.mjs:15
Medium External URL
https://creator.xiaohongshu.com/statistics/data-analysis skill.mjs:20
Medium External URL
https://www.xiaohongshu.com/ skill.mjs:21
Medium External URL
https://www.xiaohongshu.com/search_result_ai?keyword= skill.mjs:623
Dependencies and supply chain
There are no structured dependency warnings.
File composition
6 files · 1365 lines
JavaScript 2 files · 1149 linesMarkdown 3 files · 211 linesJSON 1 files · 5 lines
Files of concern · 5
skill.mjs Creator account nickname and performance data sent to external LLM · http://127.0.0.1:3459 · https://creator.xiaohongshu.com/statistics/data-analysis · https://www.xiaohongshu.com/ · https://www.xiaohongshu.com/search_result_ai?keyword=
wc3-code.mjs Obfuscated wc3-code.mjs with undeclared data exfiltration path
README.md https://clawhub.ai/fatmind/skills/webclaw3-browser-automation**
SKILL.md SKILL.md omits the obfuscated helper and LLM data flow · SKILL.md claims '不需要任何第三方 API key' but depends on webclaw3 which may use API keys · https://clawhub.ai/fatmind/skills/webclaw3-browser-automation
skill-card.md https://clawhub.ai/user/fatmind · https://clawhub.ai/fatmind/skills/xhs-note-analyst
Other files · _meta.json
Security positives
skill.mjs is clean, well-commented, readable JavaScript with no obfuscation
All browser automation goes through the documented webclaw3 Extension Relay at localhost:3459 — no direct Chromium/WebDriver instantiation
Python subprocess for xlsx parsing is declared and justified (no native Node xlsx parser available)
No credential harvesting, no ~/.ssh or ~/.aws or .env file access
No base64|bash, no curl|sh remote execution, no reverse shell patterns
skill-card.md proactively lists known risks and mitigations, showing publisher awareness
Output data stays local (HTML report, JSON, Markdown files written to user-specified paths)
No supply chain indicators: no package.json, no pip dependencies, no unpinned versions