T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/request.js:71- Finding
API Credential Transmitted in URL Query Strings
- Content
View full analysis
- Remediation
View remediation
Security audit
guaikei-viral
Security checks for vulnerabilities and agentic risk
Overview
This skill appears purpose-built for Xiaohongshu research, but it sends API credentials in URL parameters and automatically saves full results and access-bearing links to local logs without clear retention or redaction controls.
Review before installing. Use a dedicated Guaikei token with limited value, rotate it if exposed, avoid passing sensitive or private links, and treat the generated logs/ directory as sensitive because it may contain full result data and xsec_token URLs. The skill should ideally move credentials out of query strings, redact saved URLs/results, restrict log permissions, and provide an option to disable or expire logs.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
src/xiaohongshu/detail-cli.js:135- Finding
Automatic Plaintext Storage of Access-Bearing URLs and API Results
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
src/validate/url.js:3- Finding
Trusted URL Allowlist Can Be Bypassed Through Substring Matching
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (54)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
This mismatch also highlights raw result output and logging beyond the declared note-analysis workflow. When a skill emits or persists raw third-party data instead of only summarized analysis, it can unexpectedly increase data exposure and retention, particularly in agent environments that capture tool output and logs.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
This mismatch also highlights raw result output and logging beyond the declared note-analysis workflow. When a skill emits or persists raw third-party data instead of only summarized analysis, it can unexpectedly increase data exposure and retention, particularly in agent environments that capture tool output and logs.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
This mismatch also highlights raw result output and logging beyond the declared note-analysis workflow. When a skill emits or persists raw third-party data instead of only summarized analysis, it can unexpectedly increase data exposure and retention, particularly in agent environments that capture tool output and logs.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This mismatch also highlights raw result output and logging beyond the declared note-analysis workflow. When a skill emits or persists raw third-party data instead of only summarized analysis, it can unexpectedly increase data exposure and retention, particularly in agent environments that capture tool output and logs.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
This mismatch also highlights raw result output and logging beyond the declared note-analysis workflow. When a skill emits or persists raw third-party data instead of only summarized analysis, it can unexpectedly increase data exposure and retention, particularly in agent environments that capture tool output and logs.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
This mismatch also highlights raw result output and logging beyond the declared note-analysis workflow. When a skill emits or persists raw third-party data instead of only summarized analysis, it can unexpectedly increase data exposure and retention, particularly in agent environments that capture tool output and logs.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 91% confidence
- Finding
This mismatch also highlights raw result output and logging beyond the declared note-analysis workflow. When a skill emits or persists raw third-party data instead of only summarized analysis, it can unexpectedly increase data exposure and retention, particularly in agent environments that capture tool output and logs.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
This mismatch also highlights raw result output and logging beyond the declared note-analysis workflow. When a skill emits or persists raw third-party data instead of only summarized analysis, it can unexpectedly increase data exposure and retention, particularly in agent environments that capture tool output and logs.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
This mismatch also highlights raw result output and logging beyond the declared note-analysis workflow. When a skill emits or persists raw third-party data instead of only summarized analysis, it can unexpectedly increase data exposure and retention, particularly in agent environments that capture tool output and logs.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 84% confidence
- Finding
The skill requests access to a sensitive environment variable (
GUAIKEI_API_TOKEN) but does not declare any explicit tool scope such aspermissionsorallowed-tools. This weakens least-privilege boundaries and can cause an agent runtime to expose broader capabilities than users expect, especially when the skill also routes data to a third-party API service.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill documentation is entirely in Chinese and instructs users to contact support via WeChat and use Chinese-language tooling flows, but it does not state that the skill is intentionally China-region-specific or offer any language/locale opt-in. Under the policy, forcing a specific language without user choice or clear justification is a natural-language policy violation.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The manifest says the skill takes a note link and returns note details, comments, and content-analysis metrics for viral-note decomposition. However, the README describes materially broader functions including keyword-based note search, competitor account monitoring, KOL screening, and trend prediction/market monitoring. These are not just implementation details of link-based note analysis; they expand the skill's stated scope into wider surveillance and discovery workflows.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The documentation frames the tool as dedicated to Xiaohongshu data mining and repeatedly presents it as a Xiaohongshu analysis skill. Yet the capability table states '获取抖音评论详情' for comment analysis, which refers to Douyin rather than Xiaohongshu. This is an active contradiction in the documentation about what platform the skill analyzes.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This markdown content presents the skill changelog entirely in Chinese, including the title and all feature descriptions. Under the language/locale policy rule, forcing a specific language without user opt-in or justification can be a policy violation.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The changelog advertises capabilities well beyond the skill’s stated scope, including keyword search, user work monitoring, competitor analysis, KOL screening, and trend monitoring. This scope mismatch is dangerous because it can conceal undisclosed data collection or operational behavior from reviewers and users, weakening trust boundaries and making it easier for a skill to perform actions the manifest does not clearly authorize.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This file contains natural-language descriptions and later user-facing retry/error strings only in Chinese, which can amount to a language-policy violation when the skill does not provide user opt-in or indicate that it is intentionally region/language-specific. The policy allows locale constraints when clearly documented and justified, but this code file does not document such a constraint.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The retry log message is a natural-language string shown to users/operators and is fixed to Chinese. Because the file does not offer a language choice or explain that the skill is specifically for a Chinese-speaking context, this conflicts with the stated policy for language/locale handling.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This thrown error text is natural-language output and is fixed to Chinese, with no user language selection or documented locale restriction. That creates a language-policy concern under the rule for natural-language policy violations.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This error message is emitted only in Chinese and the file does not indicate that users have opted into that locale or that the skill is region-specific. Under the rule, hard-forcing a language without opt-in is a policy issue.
- Content