T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/request.js:71- Finding
API Credential Exposed in URL Query Strings
- Content
View full analysis
- Remediation
View remediation
Security audit
guaikei-detail
Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed Xiaohongshu public-data lookup and analysis tool, with some credential-handling and logging cautions but no evidence of deception, exfiltration, persistence, or destructive behavior.
Install only if you are comfortable sending Xiaohongshu keywords or URLs and your GUAIKEI_API_TOKEN to the Guaikei API. Treat the generated logs as potentially sensitive, avoid syncing or sharing the logs directory, and prefer a future version that sends the API token in an Authorization header and redacts tokenized URLs from saved output.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
src/utils/log.js:24- Finding
Token-Bearing API Results Persisted Without Explicitly Restrictive File Permissions
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (55)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The short description promises single-note detail retrieval, but the documentation includes keyword search, sorting/filtering, tokenized third-party API access, and possible log writing. This mismatch can hide the true data flows and collection scope from agents and users, increasing the chance of unintended external disclosure and excessive scraping behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The short description promises single-note detail retrieval, but the documentation includes keyword search, sorting/filtering, tokenized third-party API access, and possible log writing. This mismatch can hide the true data flows and collection scope from agents and users, increasing the chance of unintended external disclosure and excessive scraping behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The short description promises single-note detail retrieval, but the documentation includes keyword search, sorting/filtering, tokenized third-party API access, and possible log writing. This mismatch can hide the true data flows and collection scope from agents and users, increasing the chance of unintended external disclosure and excessive scraping behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The short description promises single-note detail retrieval, but the documentation includes keyword search, sorting/filtering, tokenized third-party API access, and possible log writing. This mismatch can hide the true data flows and collection scope from agents and users, increasing the chance of unintended external disclosure and excessive scraping behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The short description promises single-note detail retrieval, but the documentation includes keyword search, sorting/filtering, tokenized third-party API access, and possible log writing. This mismatch can hide the true data flows and collection scope from agents and users, increasing the chance of unintended external disclosure and excessive scraping behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The short description promises single-note detail retrieval, but the documentation includes keyword search, sorting/filtering, tokenized third-party API access, and possible log writing. This mismatch can hide the true data flows and collection scope from agents and users, increasing the chance of unintended external disclosure and excessive scraping behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The short description promises single-note detail retrieval, but the documentation includes keyword search, sorting/filtering, tokenized third-party API access, and possible log writing. This mismatch can hide the true data flows and collection scope from agents and users, increasing the chance of unintended external disclosure and excessive scraping behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The short description promises single-note detail retrieval, but the documentation includes keyword search, sorting/filtering, tokenized third-party API access, and possible log writing. This mismatch can hide the true data flows and collection scope from agents and users, increasing the chance of unintended external disclosure and excessive scraping behavior.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This file implements broad keyword-based note search and result enumeration, while the skill metadata describes only single-note detail lookup from a provided Xiaohongshu note link. That mismatch expands the skill's effective capability from targeted retrieval to scalable discovery and collection, which can enable mass profiling, content harvesting, and policy circumvention beyond user-expected scope.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The manifest says the skill takes a Xiaohongshu note link and returns complete information for one note. In this file, the argument description, help text, URL validation, task creation, and output messaging all target a blogger/profile URL and fetch homepage notes with a configurable limit, which is materially different behavior.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The manifest says the skill takes a Xiaohongshu note link and returns complete structured details for one note, but this file defines a search interface with --keyword, type/sort/time/limit filters and invokes createSearchTask/getSearchTask to retrieve multiple search results. That is a materially different capability from single-note detail lookup and content decomposition.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The manifest and all user-facing instructions/examples are written entirely in Chinese and present Chinese trigger phrases and usage patterns as the expected interaction mode. There is no indication that other languages are supported or that users may choose their preferred language, which can violate a language/locale policy when no opt-in is provided.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill manifest says this skill takes a Xiaohongshu note link and returns structured details for one note. In contrast, the package description and keywords describe broader capabilities such as mining viral posts, monitoring competitors, filtering KOLs, trend monitoring, user profiling, and growth marketing, which materially exceed a single-note detail lookup skill.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest describes only note-detail retrieval from an input Xiaohongshu link. However, the package declares multiple executable flows: search, detail, and post, indicating broader behavior than the claimed single-purpose detail query skill.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The entire skill description, usage guidance, warnings, and support instructions are presented only in Chinese, with no indication that other languages are supported or that the language restriction is optional. This creates a natural-language policy concern because it imposes a specific language/locale on users without explicit opt-in or documented justification.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The manifest describes a narrowly scoped skill for querying one Xiaohongshu note by URL and returning its structured details. In contrast, the README presents the skill as a general Xiaohongshu data-mining platform with competitor monitoring, trend prediction, KOL screening, keyword search, bulk data retrieval, and comment analysis, which materially exceeds the declared purpose.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The changelog presents all user-facing natural language exclusively in Chinese, and there is no indication that the skill is limited to a Chinese-speaking audience or that users can opt into this locale. Under the language/locale policy, forcing a specific language without user choice or documented justification is a policy concern.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The changelog advertises capabilities far beyond the declared skill purpose, including keyword search, comment sentiment analysis, user work monitoring, and broader commercial analysis features. This mismatch can mislead reviewers and users about the actual data access and operational scope, increasing the risk of undeclared collection, over-privileged integrations, or repurposing of the skill beyond what its manifest suggests.
- Content
Static analysis
No suspicious patterns detected.