T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/request.js:76- Finding
API credentials and Xiaohongshu access tokens are transmitted in URL query strings
- Content
View full analysis
- Remediation
View remediation
Security audit
guaikei-rednote-acquisition
Security checks for vulnerabilities and agentic risk
Overview
The skill does what it claims, but it handles API tokens and Xiaohongshu token-bearing links in ways users should review before installing.
Install only if you are comfortable sending Xiaohongshu keywords, links, and a Guaikei API token to www.guaikei.com. Avoid using this in shared or CI workspaces unless logs are protected or cleaned up, and do not print GUAIKEI_API_TOKEN in recorded terminals or transcripts.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
src/xiaohongshu/search-cli.js:203- Finding
Fetched data is automatically persisted in plaintext without an explicit opt-in
- Content
View full analysis
|]/g, "_") .replace(/\.\.+/g, "_") .replace(/^\.+|\.+$/g, ""); if (safeFilename.length > 200) { safeFilename = safeFilename.substring(0, 200); } if (safeFilename === "") { safeFilename = `log_${Date.now()}`; } const outputFilename = path.join( path.dirname(__filename), "..", "..", "logs", safeFilename, ); try { await fs.promises.mkdir(path.dirname(outputFilename), { recursive: true }); await fs.promises.writeFile(outputFilename, content); utils.printSuccess(` → 已保存到 ${outputFilename}`); } catch (error) { utils.printError(`日志写入失败: ${error.message}`); } } ``` ### Technical Analysis Successful CLI operations serialize the entire `finalOutput` object and save it beneath the project’s `logs/` directory. The persisted object includes request metadata and complete API results. Depending o ...[truncated 2213 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (53)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Based on the supplied code alone, the implementation shown is not aligned with the declared purpose. The code contains only generic configuration and points to 'www.guaikei.com', which is inconsistent with a Xiaohongshu-focused skill. There is no visible logic for handling Xiaohongshu links, keywords, note retrieval, comments, or blogger content. While this may be only a partial file, the chunk provided materially suggests an inconsistent target resource and lacks evidence of the declared primary behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明描述的是一个面向小红书内容检索/详情/评论/博主作品查询的技能，核心能力应涉及小红书资源访问或相关业务逻辑。但实际代码仅实现了通用 CLI 参数解析器，包括读取 flag 值、处理布尔/字符串参数、位置参数、必填项检查以及生成帮助文本。这不是对声明能力的支撑性细节，而是明显不同的基础工具模块，未体现任何小红书平台交互、笔记搜索、详情获取、评论查询或博主作品访问行为。因此描述与代码行为存在显著不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
声明描述的是一个面向小红书内容检索/查看的数据获取技能，但代码片段实际只实现了本地日志写入功能，没有任何与小红书搜索、笔记详情、评论查询、博主作品获取、网络请求或链接解析相关的行为。虽然日志能力有时可能是辅助实现细节，但当前提供的代码片段完全体现为文件系统写入工具，且其访问的资源是本地文件系统而非小红书平台数据，因此与声明的主要用途明显不一致。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description says this skill handles Xiaohongshu note/comment/blogger data retrieval. However, the supplied code chunk performs a completely different function: it uses fs/path to read a local package.json and return the package name. This is not a supporting implementation detail for the declared Xiaohongshu functionality in any meaningful way from the provided chunk; instead, the actual behavior shown is unrelated to the declared end-user purpose and involves local file access not mentioned in the description. Therefore this is a clear description-behavior mismatch.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "只拉这条笔记的评论做观点归纳: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "只拉这条笔记的评论做观点归纳: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "只拉这条笔记的评论做观点归纳: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "只拉这条笔记的评论做观点归纳: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "只拉这条笔记的评论做观点归纳: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "只拉这条笔记的评论做观点归纳: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 84% confidence
- Finding
The skill requires a sensitive environment variable (
GUAIKEI_API_TOKEN) but does not declare any explicit tool scope or permission boundary. In an agent ecosystem, missing scope declarations can cause over-broad invocation or unclear trust boundaries around secret use and outbound access to a third-party service.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The activation rule is overly broad: it says the skill should be used even if the user did not explicitly ask for 'data' or 'search', as long as they mention Xiaohongshu and want to understand content. In an agent setting, this can trigger unnecessary third-party queries and external data transmission, causing unintended network actions, privacy leakage of user-supplied links/keywords, and overreach beyond user intent.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The skill description is entirely written as a Chinese-only experience for a broad marketing/data-analysis tool, and it does not state that users may choose another language or that the restriction is required for compliance or a region-specific audience. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The file title and all changelog content are written exclusively in Chinese, which signals a language-specific presentation without any indication that users may choose another language. Under the natural-language policy check, forcing a specific language without opt-in can be a locale-policy violation unless it is clearly documented as region-specific or justified.
- Content
Static analysis
Detected: suspicious.exposed_secret_literal
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- SKILL.md:16