Security audit

guaikei-rednote-ops

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a legitimate Xiaohongshu data tool, but it needs review because it understates its breadth in the main description and handles tokens/results in ways that can expose data.

Review before installing. Use a dedicated low-privilege GUAIKEI_API_TOKEN, rotate it if exposed, avoid running this in shared or synced workspaces, and manually delete or protect the generated logs because they can contain research history, comments, profile data, and tokenized Xiaohongshu URLs.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: src/utils/request.js:76
Finding: API Credential Transmitted in URL Query Strings
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: src/utils/log.js:25
Finding: Complete Xiaohongshu Results and Tokenized URLs Persisted in Plaintext
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (80)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill's public positioning is narrowly about comment extraction for a single note, yet its documentation includes full content search with filters for type, sort, time, and limit. Such hidden breadth creates a trust gap: the agent may invoke a large-scale discovery tool where the user expected a narrowly scoped comment fetcher.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill's public positioning is narrowly about comment extraction for a single note, yet its documentation includes full content search with filters for type, sort, time, and limit. Such hidden breadth creates a trust gap: the agent may invoke a large-scale discovery tool where the user expected a narrowly scoped comment fetcher.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill's public positioning is narrowly about comment extraction for a single note, yet its documentation includes full content search with filters for type, sort, time, and limit. Such hidden breadth creates a trust gap: the agent may invoke a large-scale discovery tool where the user expected a narrowly scoped comment fetcher.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill's public positioning is narrowly about comment extraction for a single note, yet its documentation includes full content search with filters for type, sort, time, and limit. Such hidden breadth creates a trust gap: the agent may invoke a large-scale discovery tool where the user expected a narrowly scoped comment fetcher.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill's public positioning is narrowly about comment extraction for a single note, yet its documentation includes full content search with filters for type, sort, time, and limit. Such hidden breadth creates a trust gap: the agent may invoke a large-scale discovery tool where the user expected a narrowly scoped comment fetcher.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill's public positioning is narrowly about comment extraction for a single note, yet its documentation includes full content search with filters for type, sort, time, and limit. Such hidden breadth creates a trust gap: the agent may invoke a large-scale discovery tool where the user expected a narrowly scoped comment fetcher.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill's public positioning is narrowly about comment extraction for a single note, yet its documentation includes full content search with filters for type, sort, time, and limit. Such hidden breadth creates a trust gap: the agent may invoke a large-scale discovery tool where the user expected a narrowly scoped comment fetcher.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill's public positioning is narrowly about comment extraction for a single note, yet its documentation includes full content search with filters for type, sort, time, and limit. Such hidden breadth creates a trust gap: the agent may invoke a large-scale discovery tool where the user expected a narrowly scoped comment fetcher.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill's public positioning is narrowly about comment extraction for a single note, yet its documentation includes full content search with filters for type, sort, time, and limit. Such hidden breadth creates a trust gap: the agent may invoke a large-scale discovery tool where the user expected a narrowly scoped comment fetcher.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill's public positioning is narrowly about comment extraction for a single note, yet its documentation includes full content search with filters for type, sort, time, and limit. Such hidden breadth creates a trust gap: the agent may invoke a large-scale discovery tool where the user expected a narrowly scoped comment fetcher.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill's public positioning is narrowly about comment extraction for a single note, yet its documentation includes full content search with filters for type, sort, time, and limit. Such hidden breadth creates a trust gap: the agent may invoke a large-scale discovery tool where the user expected a narrowly scoped comment fetcher.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill's public positioning is narrowly about comment extraction for a single note, yet its documentation includes full content search with filters for type, sort, time, and limit. Such hidden breadth creates a trust gap: the agent may invoke a large-scale discovery tool where the user expected a narrowly scoped comment fetcher.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The manifest claims a narrow comment-only function, but the body of the skill documents broader note-detail, search, and creator-post retrieval features. Security review and runtime routing often trust manifest declarations; when those declarations understate capability, reviewers may approve access patterns they would otherwise restrict.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.
md
- "分析这条小红书笔记评论区的主要观点: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.
md
- "分析这条小红书笔记评论区的主要观点: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.
md
- "分析这条小红书笔记评论区的主要观点: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.
md
- "分析这条小红书笔记评论区的主要观点: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 147)May include surrounding context.
md
- "分析这条小红书笔记评论区的主要观点: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 229)May include surrounding context.
md
- "分析这条小红书笔记评论区的主要观点: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.
md
- "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.
md
- "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.
md
- "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 132)May include surrounding context.
md
- "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 229)May include surrounding context.
md
- "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.
md
- "只拉这条笔记的评论做观点归纳: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:16