xiaohongshu-cli
What this skill does
A CLI tool for interacting with Xiaohongshu (Little Red Book) - searching notes, reading content, browsing users, liking, collecting, commenting, following, and posting.
github/jackwener - Data Exfiltration - 2.5k stars
Threat analysis
Skill info
pkg:github/jackwener/xiaohongshu-cli@4d63f3c?skill=xiaohongshu-cliAssessments (2)
Data Exfiltration
Data Exfiltration via local-llm-review
xhs_cli/commands/creator.py
The `upload_file` method is used to upload files to the Xiaohongshu API. While this is a legitimate feature for posting notes, it could be misused to exfiltrate data if the user is tricked into uploadExcessive Agency
Excessive Agency via local-llm-review
xhs_cli/commands/_common.py
The phrase 'Run arbitrary command' appears in the code comments or documentation, suggesting the tool may allow execution of arbitrary commands, which could be a risk if not properly restricted.Badge
Add the Anomity scan badge for xiaohongshu-cli to your README.
How Anomity governs this at runtime
Scan-time vetting tells you what a skill says it will do. Anomity's Endpoint Sensor sees what agents actually do: it discovers skills alongside every other AI artifact on the endpoint, and runtime governance can allow, deny, or log the tool calls a skill triggers. Policy violations route to your SIEM, Slack, email, or Jira, backed by a queryable 90-day audit trail.
Book a 30-minute demo to see your own skill inventory.
Methodology and disputes
Every skill is assessed by the Anomity Skill Intelligence engine against its public source; findings indicate risk patterns, not confirmed exploitation. Maintainer of xiaohongshu-cli? Report an issue or request a rescan.
