T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/request.js:76- Finding
API credential exposed in request query strings
- Content
View full analysis
- Remediation
View remediation
Security audit
guaikei-rednote-analytics
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its Xiaohongshu data-collection purpose, but it handles tokens and saved results in ways users should review before installing.
Install only if you are comfortable sending Xiaohongshu targets and collected public data to Guaikei, and with the tool automatically saving complete result files locally. Treat GUAIKEI_API_TOKEN and Xiaohongshu xsec_token URLs as sensitive, avoid shared workspaces, delete logs you no longer need, and prefer a version that redacts tokens, uses headers for authentication, and makes saving opt-in.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/log.js:5- Finding
Automatic storage of complete datasets and token-bearing Xiaohongshu URLs with default file permissions
- Content
View full analysis
|]/g, "_") .replace(/\.\.+/g, "_") .replace(/^\.+|\.+$/g, ""); if (safeFilename.length > 200) { safeFilename = safeFilename.substring(0, 200); } if (safeFilename === "") { safeFilename = `log_${Date.now()}`; } const outputFilename = path.join( path.dirname(__filename), "..", "..", "logs", safeFilename, ); try { await fs.promises.mkdir(path.dirname(outputFilename), { recursive: true }); await fs.promises.writeFile(outputFilename, content); utils.printSuccess(` → 已保存到 ${outputFilename}`); } catch (error) { utils.printError(`日志写入失败: ${error.message}`); } } ``` The detail CLI includes the original URL and complete API result in the stored object: ```js const finalOutput = { status: "success", error_code: "OK", message: "详情任务完成", timestamp: new Date().toLocaleString(), request: { command: "detail", url: url, limit: limit, }, skill_metadata: { skill_version: constants.VERSION, runtime_version: process.versions.node, execution_time: Date.now() - startTime, }, results: detailTask, }; console.log(JSON.stringify(finalOutput, null, 2)); utils.p ...[truncated 3651 chars]- Remediation
View remediation
` or `--save` option. 2. Redact sensitive query parameters before printing or saving URLs: - `xsec_token` - `token` - Any future authentication or signed-link parameters. 3. Create the log directory and files with owner-only permissions: ```js await fs.promises.mkdir(logDirectory, { recursive: true, mode: 0o700, }); await fs.promises.writeFile(outputFilename, redactedContent, { mode: 0o600, flag: "wx", }); ``` 4. Use `flag: "wx"` or another safe collision policy to avoid silently overwriting an existing file. 5. Store only fields necessary for the user's requested output instead of retaining the complete response by default. 6. Implement configurable retention and provide a cleanup command or automatic expiration policy. 7. Avoid storing collected content in repository directories that may be committed, synchronized, or packaged. Add `logs/` to `.gitignore`. 8. Clearly document persistent storage, retained fields, location, permissions, and deletion behavior in `SKILL.md`. 9. For environments requiring long-term retention, encrypt stored results using a user-controlled key and avoid embedding secrets in filenames or metadata. 10. Add tests confirming that stored output contains no `xsec_token`, API token, or other configured secret. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (72)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
声明描述的核心能力是账号级别的竞品/博主分析，前提应包含抓取博主公开作品列表，并结合多篇笔记详情与评论进行汇总分析。但这段代码只处理“单个笔记链接”的详情与评论任务创建和查询，没有任何博主主页作品列表抓取、遍历作品、聚合多篇内容、节奏分析或竞品监控逻辑。虽然其中包含笔记详情和评论这一子能力，且生成作者主页 URL 与领域相关，但就该代码块本身而言，其主要行为明显窄于且不同于声明的主要用途，因此应判定为描述与行为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
声明描述的核心能力是围绕“指定博主账号”做内容分析，重点在博主公开作品列表、笔记详情和评论数据的采集，以还原账号表现。而这段代码仅调用 /note-search/keyword 和 /note-search/info 两个接口执行关键词搜索任务，并对返回结果补充笔记/用户URL。它的主要用途是内容搜索，不是账号作品聚合分析。虽然都属于小红书公开内容范围，且未涉及登录态或私密数据，但主功能、输入方式和数据范围均与声明不一致，因此应判定为描述与实际行为存在明显不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明描述的是一个面向小红书公开内容抓取与竞品分析的技能，核心能力应包括访问小红书公开页面/API、提取作品列表/笔记详情/评论并进行分析。而实际代码仅是 src/utils/args.js，一个与具体业务无关的 CLI 参数解析器和帮助文本生成器。它没有访问任何外部资源，没有处理小红书链接或博主数据，也没有执行抓取、分析或监控相关逻辑。这不是单纯的支持性实现细节，因为当前提供的代码块本身完全体现的是另一种通用工具用途，与声明的主要目的明显不一致。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
声明描述的核心能力是抓取和分析小红书博主公开内容，但提供的代码块实际只是在做API TOKEN格式校验与服务可用性门控，并附带引导用户通过微信获取私有TOKEN的提示。这与声明的主要用途明显不一致。虽然这可能是整体技能中的辅助模块，但就该代码块本身而言，没有展示任何与小红书页面访问、作品列表抓取、详情/评论解析或内容表现分析相关的行为，因此应判定为描述与实际行为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明描述的是一个面向小红书公开数据采集与竞品分析的技能；但给出的代码片段仅实现了本地日志文件写入功能，使用了 fs/path 访问和修改本地文件系统。这与声明的主要目的明显不一致，也引入了未声明的资源访问能力（本地文件写入）。虽然日志功能可能作为辅助实现存在，但当前提供的代码本身没有体现任何与小红书数据抓取、笔记详情、评论分析或竞品监控直接相关的行为，因此应判定为描述与实际行为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared purpose is a Xiaohongshu public-content scraping and analysis skill. The supplied code chunk does not implement any of that behavior. Instead, it performs a simple local utility function: reading package.json from the filesystem and returning the package name. This is materially different from the declared primary purpose and uses an unrelated resource. While this may be a harmless helper within a larger skill, based on the provided chunk alone, the behavior does not match the declared description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
该代码片段的主要职责是输入校验：检查关键词是否为空、长度是否合规、是否含特殊字符或 http 链接，并清洗关键词字符集，同时规范搜索参数取值范围。这与声明中的核心能力——抓取指定博主公开内容并进行内容/互动分析——存在明显偏差。尤其是声明说明用户提供博主主页链接也适用，但代码明确将包含 http 的关键词判为无效，说明其面向的是普通搜索词而不是主页链接输入。因此这是实质性描述与行为不一致。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
声明描述的是博主账号级别的数据采集与竞品分析场景，核心应包括博主公开作品列表抓取，并进一步结合多篇笔记详情和评论进行汇总分析。但这段代码仅实现了单个笔记详情与评论抓取的命令行入口：它要求传入“笔记链接”，调用 detail.createDetailTask / getDetailTask 获取单篇内容结果，输出 JSON，并写入本地文件。代码没有显示任何博主主页解析、作品列表遍历、跨笔记聚合分析或账号层面的节奏/风格分析逻辑。因此其主要目的与声明存在明显偏差。虽然‘笔记详情与评论’是声明中的组成部分之一，但单独这段代码不足以支撑所宣称的技能整体用途，且触发输入对象也从‘博主主页链接’变成了‘笔记链接’，属于实质性不一致。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
声明描述的是一个较完整的竞品分析能力：不仅抓取公开作品列表，还要配合笔记详情与评论来还原发布节奏、内容风格和互动表现。但给出的代码片段仅实现了一个
post-cli命令行入口：解析参数、校验博主主页链接、调用createPostTask/getPostTask获取“主页笔记任务”结果、输出 JSON 并记录日志。根据代码可直接确认的行为，核心是拉取博主主页笔记数据；看不到评论抓取、详情抓取或任何分析逻辑。虽然这些能力可能存在于未展示的其他模块或远端 API 返回中，但就该代码片段本身而言，其实际行为比声明更窄，无法支撑“配合笔记详情与评论进行内容与互动分析”的完整描述，因此应判定为描述与代码行为不一致。- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
声明的核心用途是“博主账号/主页分析”，即围绕特定博主收集其公开作品列表，并配合笔记详情与评论做竞品分析。该代码片段的核心行为则是通用的关键词搜索：接受搜索词和筛选条件，向搜索 API 创建并获取搜索任务，最后输出匹配内容结果。代码中没有看到博主主页 URL 处理、博主作品列表抓取、笔记详情抓取、评论抓取，或任何围绕单个博主的聚合分析逻辑。因此其主要功能与声明存在实质性偏差。环境变量 token 和日志记录属于实现细节，不构成额外风险点；问题在于主功能明显不是所声明的“博主竞品分析抓取”。
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "只拉这条笔记的评论做观点归纳: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "只拉这条笔记的评论做观点归纳: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "只拉这条笔记的评论做观点归纳: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "只拉这条笔记的评论做观点归纳: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"