Claude Code, Skill
Xiaohongshu Skill
Xiaohongshu Skill, a skill listed in the PlugVet directory.
Compatibility: Not stated.
Grade C
One Medium finding. Read the report before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
NETWORK_HOST_FROM_INPUT
Why this grade
- NETWORK_HOST_FROM_INPUT Medium
A file takes a URL or endpoint as input and has no fixed host list.
extension/background.js, line 117
const socket = new WebSocket(BRIDGE_URL);
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
scripts/cli.py, line 59
subprocess.Popen(["open", path])
scripts/cli.py, line 61
subprocess.Popen(["xdg-open", path])
scripts/cli.py, line 88
result = subprocess.run(
Show more
scripts/cli.py, line 107
result = subprocess.run(command, capture_output=True, check=False, text=True)
scripts/cli.py, line 160
subprocess.run(
scripts/cli.py, line 166
subprocess.run(["taskkill", "/PID", str(pid)], check=False, timeout=15)
scripts/cli.py, line 213
subprocess.Popen(
scripts/cli.py, line 274
process = subprocess.Popen([path])
scripts/run_lock.py, line 62
os.remove(self.lock_file)
scripts/run_lock.py, line 80
os.remove(self.lock_file)
scripts/xhs/cookies.py, line 59
os.remove(path)
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Serious
accepts a host from input, with no fixed list in this file.
NETWORK_HOST_FROM_INPUT
extension/background.js, line 117
const socket = new WebSocket(BRIDGE_URL);
extension/background.js, line 1667
const resp = await fetch(probe.url, opts);
extension/netlogger.js, line 397
// interceptor 可能拿到相对路径 (fetch("/api/foo")) 或绝对路径
Show more
scripts/video_processor.py, line 138
with requests.get(url, headers=headers, stream=True, timeout=(15, 120)) as response:
scripts/xhs/cdp.py, line 634
resp = requests.get(f"{self.base_url}/json/version", timeout=5)
scripts/xhs/cdp.py, line 681
resp = requests.get(f"{self.base_url}/json", timeout=5)
scripts/xhs/cdp.py, line 730
resp = requests.get(f"{self.base_url}/json", timeout=5)
Secrets
Concern
reads a credential or environment file.
SECRETS_PATH_UNCONFIRMED
.gitignore, line 137
# Environments
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Pass
No encoded or minified payload found.
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 8404b73e9640. can delete files. accepts a host from input, with no fixed list in this file. reads a credential or environment file.
Date and source
Date checked:
github.com
Commit graded: 8404b73e9640594db11da111234758c73f36cb0f
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.