T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/request.js:71- Finding
API Credential Exposed in URL Query Parameters
- Content
View full analysis
- Remediation
View remediation
Security audit
guaikei-comment
Security checks for vulnerabilities and agentic risk
Overview
The skill appears to be a legitimate Xiaohongshu public-data integration, but its short description understates its broader collection features and its API token handling has avoidable security risk.
Install only if you are comfortable sending Xiaohongshu keywords, note/profile URLs, and your GUAIKEI API token to the third-party service. Treat it as a broader Xiaohongshu research and monitoring tool, not only a single-note comment collector, and avoid using sensitive or private inputs.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
src/validate/url.js:3- Finding
Domain Allowlist Bypass Through Substring-Based URL Validation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (65)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill is declared as a comment collector for a single note, but the documented interface includes search filters and search-task workflows. In context, this makes the skill more dangerous because it is an external data-harvesting integration, so inaccurate labeling weakens oversight of what third-party collection operations are actually being authorized.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill is declared as a comment collector for a single note, but the documented interface includes search filters and search-task workflows. In context, this makes the skill more dangerous because it is an external data-harvesting integration, so inaccurate labeling weakens oversight of what third-party collection operations are actually being authorized.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill is declared as a comment collector for a single note, but the documented interface includes search filters and search-task workflows. In context, this makes the skill more dangerous because it is an external data-harvesting integration, so inaccurate labeling weakens oversight of what third-party collection operations are actually being authorized.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill is declared as a comment collector for a single note, but the documented interface includes search filters and search-task workflows. In context, this makes the skill more dangerous because it is an external data-harvesting integration, so inaccurate labeling weakens oversight of what third-party collection operations are actually being authorized.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill is declared as a comment collector for a single note, but the documented interface includes search filters and search-task workflows. In context, this makes the skill more dangerous because it is an external data-harvesting integration, so inaccurate labeling weakens oversight of what third-party collection operations are actually being authorized.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill is declared as a comment collector for a single note, but the documented interface includes search filters and search-task workflows. In context, this makes the skill more dangerous because it is an external data-harvesting integration, so inaccurate labeling weakens oversight of what third-party collection operations are actually being authorized.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill is declared as a comment collector for a single note, but the documented interface includes search filters and search-task workflows. In context, this makes the skill more dangerous because it is an external data-harvesting integration, so inaccurate labeling weakens oversight of what third-party collection operations are actually being authorized.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill is declared as a comment collector for a single note, but the documented interface includes search filters and search-task workflows. In context, this makes the skill more dangerous because it is an external data-harvesting integration, so inaccurate labeling weakens oversight of what third-party collection operations are actually being authorized.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill is declared as a comment collector for a single note, but the documented interface includes search filters and search-task workflows. In context, this makes the skill more dangerous because it is an external data-harvesting integration, so inaccurate labeling weakens oversight of what third-party collection operations are actually being authorized.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill is declared as a comment collector for a single note, but the documented interface includes search filters and search-task workflows. In context, this makes the skill more dangerous because it is an external data-harvesting integration, so inaccurate labeling weakens oversight of what third-party collection operations are actually being authorized.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The implementation in this file performs published-post task creation and retrieval for blogger/profile URLs, which materially conflicts with the skill manifest claiming note-comment collection. This mismatch can cause the agent to access and return a different class of data than the user expects, undermining consent, least privilege, and downstream safety controls that rely on accurate skill descriptions.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The file implements note-search capabilities even though the skill metadata says the skill should only collect comments for a user-supplied note link. This mismatch expands the skill's effective scope to broader content discovery and collection, which can enable undisclosed data gathering and violates least-privilege and user expectation boundaries.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The CLI schema and help text clearly implement collection of a Xiaohongshu profile URL and a post limit, not a note URL and comment limit as promised by the skill manifest. This semantic mismatch is dangerous because users may authorize or run the skill believing it only fetches public comments for one note, while it actually targets a broader profile-post collection workflow and can collect different data than expected.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The runtime behavior, request object, messages, and output all indicate a 'post' task over a blogger profile, contradicting the manifest's promised note-comment extraction workflow. In a data-collection skill, this kind of implementation/manifest drift materially increases risk because it can cause users and integrators to disclose different URLs, retrieve broader datasets, and mishandle downstream privacy expectations.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The file implements a generic keyword-based Xiaohongshu search CLI, while the skill metadata describes a narrowly scoped comment-collection capability for a provided note URL. This scope mismatch expands the agent's effective data-access and discovery surface, enabling content enumeration and collection beyond the user's expected task, which is dangerous in agent settings because operators may grant or run the skill under false assumptions.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The manifest title and description market the skill as a comment collector, while the body documents broader scraping and monitoring use cases. Security review and users often rely on manifest metadata first, so this discrepancy can lead to underestimating the scope of external data collection and approval requirements.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The manifest implies only note-link plus comment-limit inputs, but the routing section introduces unrelated keyword and creator-profile workflows. This is dangerous because upstream systems may permit the skill under a narrow data-access assumption while it actually enables broader collection from search and profile surfaces.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The section explicitly recommends only Chinese natural-language trigger phrasing for better recognition, and the entire skill description/invocation guidance is presented as Chinese-only without any opt-in or alternative locale handling. This can violate a language/locale policy when a skill effectively requires one language rather than letting the user choose.
- Content