安全决策报告
xhs-note-analyst (账号诊断)
Core helper wc3-code.mjs is fully obfuscated, undeclared in SKILL.md, and can exfiltrate prompts to an arbitrary configurable LLM endpoint; skill-card.md acknowledges this risk but SKILL.md does not.
最直接的威胁证据
高危 代码混淆
Obfuscated wc3-code.mjs with undeclared data exfiltration path wc3-code.mjs is the skill's LLM pipeline agent (invoked by skill.mjs via spawn). The entire file uses string-encoding/obfuscation with a self-decoding pattern, making static analysis and audit impossible. It reads WC3_LLM_ENDPOINT from the environment (defaulting to local pipeline but configurable to any URL) and sends full prompts (containing note titles, creator data, benchmarks, and analysis context) to that endpoint. SKILL.md makes no mention of this file or its role. skill-card.md acknowledges the obfuscation risk but SKILL.md does not.
wc3-code.mjs:1 为什么得出这个结论
2/4 个维度触发 阻止
声明与实际能力
发现 1 项声明之外的能力或越权行为。
复核
隐藏执行与外联
提取到 8 个一般风险产物，需要结合上下文判断。
阻止
攻击链与高危发现
报告包含 0 步攻击链，另有 1 项高危或严重发现。
复核
依赖与供应链卫生
没有完整依赖信息，供应链判断需要保留弹性。
风险分是怎么被拉高的
Obfuscated core helper undeclared in SKILL.md +20
wc3-code.mjs is entirely string-encoded/obfuscated and referenced by skill.mjs as the LLM pipeline agent, but SKILL.md does not mention it or its data-sending role
Configurable external LLM endpoint with no allowlist +15
WC3_LLM_ENDPOINT defaults to local pipeline but can be set to any URL via env var; prompts containing note titles and creator data are sent there
SKILL.md vs skill-card.md disclosure gap +10
skill-card.md (same package) lists obfuscation as a known risk, but SKILL.md — the primary operational doc — makes no mention of it
Legitimate architecture with webclaw3 dependency +-5
Browser relay at localhost:3459 and Python subprocess for xlsx parsing are declared and reasonable for the use case
No hard malicious indicators +-10
No credential harvesting, no network exfiltration, no reverse shell, no base64|bash chains. Actual behavior matches stated purpose.
最关键的证据
高危 代码混淆
Obfuscated wc3-code.mjs with undeclared data exfiltration path
wc3-code.mjs is the skill's LLM pipeline agent (invoked by skill.mjs via spawn). The entire file uses string-encoding/obfuscation with a self-decoding pattern, making static analysis and audit impossible. It reads WC3_LLM_ENDPOINT from the environment (defaulting to local pipeline but configurable to any URL) and sends full prompts (containing note titles, creator data, benchmarks, and analysis context) to that endpoint. SKILL.md makes no mention of this file or its role. skill-card.md acknowledges the obfuscation risk but SKILL.md does not.
wc3-code.mjs:1 Replace wc3-code.mjs with clear, auditable code. Declare the LLM endpoint in SKILL.md and add environment-variable allowlisting.
中危 文档欺骗
SKILL.md omits the obfuscated helper and LLM data flow
SKILL.md describes the analysis workflow as reading Excel, searching, and generating HTML, but never mentions that prompts are sent to an LLM endpoint via a separate helper script. The wc3-code.mjs file is the actual mechanism for keyword extraction, benchmark selection, and action generation, yet it is invisible in SKILL.md. skill-card.md (in the same package) does flag this but SKILL.md — the primary user-facing operational doc — is silent.
SKILL.md:1 Add a 'Architecture' section to SKILL.md naming wc3-code.mjs, describing that prompts with note data are sent to the webclaw3 pipeline LLM, and document what data fields are included.
中危 敏感访问
Creator account nickname and performance data sent to external LLM
The skill extracts the user's creator account nickname from the Xiaohongshu creator dashboard page (skill.mjs:401-402) and sends it alongside all note titles, metrics, and analysis context to the LLM endpoint via wc3-code.mjs. This is business-sensitive personal account data. While sent to the local webclaw3 pipeline by default, the endpoint is user-configurable via WC3_LLM_ENDPOINT with no allowlist guard.
skill.mjs:401 Document what creator account data is sent to the LLM. Consider hash/anonymize nickname before inclusion in prompts if the pipeline endpoint could be reconfigured.
低危 文档欺骗
SKILL.md claims '不需要任何第三方 API key' but depends on webclaw3 which may use API keys
SKILL.md emphasizes no third-party API key is needed, but webclaw3's local pipeline service (running at :3460) is powered by an LLM backend which may consume API credentials. The skill itself doesn't provide keys, but the dependency infrastructure may.
SKILL.md:35 Clarify that webclaw3's pipeline requires its own API key configuration and that the local pipeline must be set up separately.
声明能力 vs 实际能力
文件系统 通过
声明 WRITE
→ 推断 WRITE
skill.mjs:905-910 writes report HTML, res.json, data.md to user-specified paths 网络访问 通过
声明 READ
→ 推断 READ
skill.mjs:16 relayCall POSTs to http://127.0.0.1:3459 (webclaw3 browser relay); search URLs to xiaohongshu.com 命令执行 通过
声明 WRITE
→ 推断 WRITE
skill.mjs:380 spawn('python3', ...) for xlsx parsing; skill.mjs:113 spawn('node', [WC3_CODE]) for LLM subsessions — both documented 技能调用 通过
声明 NONE
→ 推断 NONE
No dynamic skill invocation detected 浏览器 通过
声明 READ
→ 推断 READ
skill.mjs:24 relayCall wraps Extension Relay HTTP API at :3459; all browser ops go through it 环境变量 阻止
声明 NONE
→ 推断 READ
wc3-code.mjs reads process.env.WC3_LLM_ENDPOINT — undeclared env access in an obfuscated helper 剪贴板 通过
声明 NONE
→ 推断 NONE
No clipboard access detected 数据库 通过
声明 NONE
→ 推断 NONE
No database access detected 可疑产物与外联
中危 外部 URL
https://clawhub.ai/fatmind/skills/webclaw3-browser-automation** README.md:25
中危 外部 URL
https://clawhub.ai/fatmind/skills/webclaw3-browser-automation SKILL.md:19
中危 外部 URL
https://clawhub.ai/user/fatmind skill-card.md:9
中危 外部 URL
https://clawhub.ai/fatmind/skills/xhs-note-analyst skill-card.md:39
中危 外部 URL
http://127.0.0.1:3459 skill.mjs:15
中危 外部 URL
https://creator.xiaohongshu.com/statistics/data-analysis skill.mjs:20
中危 外部 URL
https://www.xiaohongshu.com/ skill.mjs:21
中危 外部 URL
https://www.xiaohongshu.com/search_result_ai?keyword= skill.mjs:623
依赖与供应链
没有结构化依赖告警。
文件构成
6 个文件 · 1365 行
JavaScript 2 个文件 · 1149 行Markdown 3 个文件 · 211 行JSON 1 个文件 · 5 行
需关注文件 · 5
skill.mjs Creator account nickname and performance data sent to external LLM · http://127.0.0.1:3459 · https://creator.xiaohongshu.com/statistics/data-analysis · https://www.xiaohongshu.com/ · https://www.xiaohongshu.com/search_result_ai?keyword=
wc3-code.mjs Obfuscated wc3-code.mjs with undeclared data exfiltration path
README.md https://clawhub.ai/fatmind/skills/webclaw3-browser-automation**
SKILL.md SKILL.md omits the obfuscated helper and LLM data flow · SKILL.md claims '不需要任何第三方 API key' but depends on webclaw3 which may use API keys · https://clawhub.ai/fatmind/skills/webclaw3-browser-automation
skill-card.md https://clawhub.ai/user/fatmind · https://clawhub.ai/fatmind/skills/xhs-note-analyst
其他文件 · _meta.json
安全亮点
skill.mjs is clean, well-commented, readable JavaScript with no obfuscation
All browser automation goes through the documented webclaw3 Extension Relay at localhost:3459 — no direct Chromium/WebDriver instantiation
Python subprocess for xlsx parsing is declared and justified (no native Node xlsx parser available)
No credential harvesting, no ~/.ssh or ~/.aws or .env file access
No base64|bash, no curl|sh remote execution, no reverse shell patterns
skill-card.md proactively lists known risks and mitigations, showing publisher awareness
Output data stays local (HTML report, JSON, Markdown files written to user-specified paths)
No supply chain indicators: no package.json, no pip dependencies, no unpinned versions