T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/request.js:76- Finding
API Credential Exposure Through URL Query Parameters
- Content
View full analysis
- Remediation
View remediation
Security audit
guaikei-rednote-intel
Security checks for vulnerabilities and agentic risk
Overview
The skill appears to perform Xiaohongshu data collection as described, but it handles its API token and saved result files in ways users should review before installing.
Install only if you are comfortable sending Xiaohongshu keywords, links, xsec_token-bearing URLs, and a Guaikei API token to www.guaikei.com. Treat the API token as sensitive, rotate it if exposed, and review or delete the generated logs directory after use, especially in shared workspaces or repositories.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
src/utils/log.js:5- Finding
Automatic Persistent Storage of Complete API Results Without Explicit Consent or Restrictive Permissions
- Content
View full analysis
|]/g, "_") .replace(/\.\.+/g, "_") .replace(/^\.+|\.+$/g, ""); if (safeFilename.length > 200) { safeFilename = safeFilename.substring(0, 200); } if (safeFilename === "") { safeFilename = `log_${Date.now()}`; } const outputFilename = path.join( path.dirname(__filename), "..", "..", "logs", safeFilename, ); try { await fs.promises.mkdir(path.dirname(outputFilename), { recursive: true }); await fs.promises.writeFile(outputFilename, content); utils.printSuccess(`Saved to ${outputFilename}`); } catch (error) { utils.printError(`Log write failed: ${error.message}`); } } ``` Successful CLI execution automatically passes the complete output object to this function: ```js await log.taskWrite( `${startTime}_${validator.url2Name(url)}_detail.json`, JSON.stringify(finalOutput, null, 2), ); ``` The search, comment, and post commands use the same persistence behavior. ### Technical Analysis Every successful operation writes the complete structured result to a project-local `logs/` directory. The stored object includes request metadata and returned API data. Depending on the command and remote response, this can include: - Search keywords - Xiaohongshu note and profi ...[truncated 2216 chars]- Remediation
View remediation
` or `--save`. 2. Do not create result files by default when standard output already supplies the response. 3. Clearly disclose what is stored, where it is stored, and how long it is retained in `SKILL.md` and the user-facing help. 4. If persistence is enabled, create files with restrictive permissions: ```js await fs.promises.writeFile(outputFilename, content, { encoding: "utf8", mode: 0o600, flag: "wx", }); ``` 5. Create the output directory with restrictive permissions and verify existing directory ownership before writing. 6. Redact URL-level security tokens and any unnecessary account identifiers before persistence. 7. Provide configurable retention and secure deletion behavior. 8. Add `logs/` to a project `.gitignore` file and exclude it from packaging and backups where appropriate. 9. Warn the user before storing large or potentially sensitive datasets. 10. Consider encrypting result files when persistent storage is a required feature. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (81)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
If the implementation is keyword search plus filtering and logging, but the manifest says it is only for pasted-link routing, then the skill's activation surface is broader than disclosed. Broader-than-declared input handling can result in unnecessary externalization of user prompts and search terms.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
If the implementation is keyword search plus filtering and logging, but the manifest says it is only for pasted-link routing, then the skill's activation surface is broader than disclosed. Broader-than-declared input handling can result in unnecessary externalization of user prompts and search terms.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
If the implementation is keyword search plus filtering and logging, but the manifest says it is only for pasted-link routing, then the skill's activation surface is broader than disclosed. Broader-than-declared input handling can result in unnecessary externalization of user prompts and search terms.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
If the implementation is keyword search plus filtering and logging, but the manifest says it is only for pasted-link routing, then the skill's activation surface is broader than disclosed. Broader-than-declared input handling can result in unnecessary externalization of user prompts and search terms.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
If the implementation is keyword search plus filtering and logging, but the manifest says it is only for pasted-link routing, then the skill's activation surface is broader than disclosed. Broader-than-declared input handling can result in unnecessary externalization of user prompts and search terms.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
If the implementation is keyword search plus filtering and logging, but the manifest says it is only for pasted-link routing, then the skill's activation surface is broader than disclosed. Broader-than-declared input handling can result in unnecessary externalization of user prompts and search terms.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
If the implementation is keyword search plus filtering and logging, but the manifest says it is only for pasted-link routing, then the skill's activation surface is broader than disclosed. Broader-than-declared input handling can result in unnecessary externalization of user prompts and search terms.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
If the implementation is keyword search plus filtering and logging, but the manifest says it is only for pasted-link routing, then the skill's activation surface is broader than disclosed. Broader-than-declared input handling can result in unnecessary externalization of user prompts and search terms.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
If the implementation is keyword search plus filtering and logging, but the manifest says it is only for pasted-link routing, then the skill's activation surface is broader than disclosed. Broader-than-declared input handling can result in unnecessary externalization of user prompts and search terms.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
If the implementation is keyword search plus filtering and logging, but the manifest says it is only for pasted-link routing, then the skill's activation surface is broader than disclosed. Broader-than-declared input handling can result in unnecessary externalization of user prompts and search terms.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
If the implementation is keyword search plus filtering and logging, but the manifest says it is only for pasted-link routing, then the skill's activation surface is broader than disclosed. Broader-than-declared input handling can result in unnecessary externalization of user prompts and search terms.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
If the implementation is keyword search plus filtering and logging, but the manifest says it is only for pasted-link routing, then the skill's activation surface is broader than disclosed. Broader-than-declared input handling can result in unnecessary externalization of user prompts and search terms.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
If the implementation is keyword search plus filtering and logging, but the manifest says it is only for pasted-link routing, then the skill's activation surface is broader than disclosed. Broader-than-declared input handling can result in unnecessary externalization of user prompts and search terms.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
If the implementation is keyword search plus filtering and logging, but the manifest says it is only for pasted-link routing, then the skill's activation surface is broader than disclosed. Broader-than-declared input handling can result in unnecessary externalization of user prompts and search terms.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
If the implementation is keyword search plus filtering and logging, but the manifest says it is only for pasted-link routing, then the skill's activation surface is broader than disclosed. Broader-than-declared input handling can result in unnecessary externalization of user prompts and search terms.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
If the implementation is keyword search plus filtering and logging, but the manifest says it is only for pasted-link routing, then the skill's activation surface is broader than disclosed. Broader-than-declared input handling can result in unnecessary externalization of user prompts and search terms.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
If the implementation is keyword search plus filtering and logging, but the manifest says it is only for pasted-link routing, then the skill's activation surface is broader than disclosed. Broader-than-declared input handling can result in unnecessary externalization of user prompts and search terms.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"