T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/request.js:77- Finding
API Credential Exposed in URL Query Strings
- Content
View full analysis
- Remediation
View remediation
Security audit
guaikei-rednote-growth
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a coherent public Xiaohongshu data tool, but it handles credentials and saved results in ways users should review before installing.
Review this before installing if your API token or Xiaohongshu research history is sensitive. Expect keywords, URLs, limits, and your GUAIKEI_API_TOKEN to be sent to guaikei.com, and expect full command results to be saved under logs/. Avoid committing or syncing those logs, delete them when no longer needed, and rotate the API token if you suspect URL logs may have exposed it.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
src/xiaohongshu/detail-cli.js:137- Finding
Automatic Plaintext Retention of Complete API Results and Access-Bearing URLs
- Content
View full analysis
- Remediation
View remediation
` or `--save`. 2. Do not automatically retain complete API responses by default. 3. Redact sensitive query parameters before printing or saving URLs, including `xsec_token`, `token`, and similarly named values. 4. Create the output directory and files with restrictive permissions: ```js await fs.promises.mkdir(outputDirectory, { recursive: true, mode: 0o700, }); await fs.promises.writeFile(outputFilename, redactedContent, { mode: 0o600, flag: "wx", }); ``` 5. Use `flag: "wx"` or another deliberate collision strategy to prevent unintended overwrites. 6. Add configurable retention and a cleanup command for old result files. 7. Clearly document local persistence, file location, retained fields, permissions, and cleanup behavior in `SKILL.md`. 8. Warn users not to commit or synchronize the `logs/` directory, and include `logs/` in the project's ignore rules where appropriate. 9. Add tests verifying that persisted output does not contain sensitive URL parameters. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (83)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Even where keyword search exists, the description is narrower than the documented behavior: multiple sort modes, broader time ranges, and a more general search/analysis workflow than 'latest recent trends' alone. Overly narrow declarations are dangerous because they can understate data collection breadth and lead agents to auto-select the skill in contexts where users did not intend broader retrieval.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Even where keyword search exists, the description is narrower than the documented behavior: multiple sort modes, broader time ranges, and a more general search/analysis workflow than 'latest recent trends' alone. Overly narrow declarations are dangerous because they can understate data collection breadth and lead agents to auto-select the skill in contexts where users did not intend broader retrieval.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Even where keyword search exists, the description is narrower than the documented behavior: multiple sort modes, broader time ranges, and a more general search/analysis workflow than 'latest recent trends' alone. Overly narrow declarations are dangerous because they can understate data collection breadth and lead agents to auto-select the skill in contexts where users did not intend broader retrieval.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
Even where keyword search exists, the description is narrower than the documented behavior: multiple sort modes, broader time ranges, and a more general search/analysis workflow than 'latest recent trends' alone. Overly narrow declarations are dangerous because they can understate data collection breadth and lead agents to auto-select the skill in contexts where users did not intend broader retrieval.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Even where keyword search exists, the description is narrower than the documented behavior: multiple sort modes, broader time ranges, and a more general search/analysis workflow than 'latest recent trends' alone. Overly narrow declarations are dangerous because they can understate data collection breadth and lead agents to auto-select the skill in contexts where users did not intend broader retrieval.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Even where keyword search exists, the description is narrower than the documented behavior: multiple sort modes, broader time ranges, and a more general search/analysis workflow than 'latest recent trends' alone. Overly narrow declarations are dangerous because they can understate data collection breadth and lead agents to auto-select the skill in contexts where users did not intend broader retrieval.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Even where keyword search exists, the description is narrower than the documented behavior: multiple sort modes, broader time ranges, and a more general search/analysis workflow than 'latest recent trends' alone. Overly narrow declarations are dangerous because they can understate data collection breadth and lead agents to auto-select the skill in contexts where users did not intend broader retrieval.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Even where keyword search exists, the description is narrower than the documented behavior: multiple sort modes, broader time ranges, and a more general search/analysis workflow than 'latest recent trends' alone. Overly narrow declarations are dangerous because they can understate data collection breadth and lead agents to auto-select the skill in contexts where users did not intend broader retrieval.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
Even where keyword search exists, the description is narrower than the documented behavior: multiple sort modes, broader time ranges, and a more general search/analysis workflow than 'latest recent trends' alone. Overly narrow declarations are dangerous because they can understate data collection breadth and lead agents to auto-select the skill in contexts where users did not intend broader retrieval.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Even where keyword search exists, the description is narrower than the documented behavior: multiple sort modes, broader time ranges, and a more general search/analysis workflow than 'latest recent trends' alone. Overly narrow declarations are dangerous because they can understate data collection breadth and lead agents to auto-select the skill in contexts where users did not intend broader retrieval.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Even where keyword search exists, the description is narrower than the documented behavior: multiple sort modes, broader time ranges, and a more general search/analysis workflow than 'latest recent trends' alone. Overly narrow declarations are dangerous because they can understate data collection breadth and lead agents to auto-select the skill in contexts where users did not intend broader retrieval.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Even where keyword search exists, the description is narrower than the documented behavior: multiple sort modes, broader time ranges, and a more general search/analysis workflow than 'latest recent trends' alone. Overly narrow declarations are dangerous because they can understate data collection breadth and lead agents to auto-select the skill in contexts where users did not intend broader retrieval.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Even where keyword search exists, the description is narrower than the documented behavior: multiple sort modes, broader time ranges, and a more general search/analysis workflow than 'latest recent trends' alone. Overly narrow declarations are dangerous because they can understate data collection breadth and lead agents to auto-select the skill in contexts where users did not intend broader retrieval.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Even where keyword search exists, the description is narrower than the documented behavior: multiple sort modes, broader time ranges, and a more general search/analysis workflow than 'latest recent trends' alone. Overly narrow declarations are dangerous because they can understate data collection breadth and lead agents to auto-select the skill in contexts where users did not intend broader retrieval.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
Even where keyword search exists, the description is narrower than the documented behavior: multiple sort modes, broader time ranges, and a more general search/analysis workflow than 'latest recent trends' alone. Overly narrow declarations are dangerous because they can understate data collection breadth and lead agents to auto-select the skill in contexts where users did not intend broader retrieval.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"