Security audit

guaikei-xhs-author-tracker

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real Xiaohongshu data-collection skill, but it needs Review because its top description understates broader search and author-tracking capabilities and its API token is sent in URL parameters.

Install only if you want a broader Xiaohongshu research tool, not just a single-note comment retriever. Use a dedicated token you can rotate, avoid submitting sensitive or private links, and remember that returned public-profile, note, and comment data will be sent to the third-party API service and saved locally in logs.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: src/utils/request.js:78
Finding: API Token Exposure Through URL Query Parameters
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (83)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The documentation exposes a full keyword-search workflow with filtering and task completion semantics, which is materially broader than single-note comment retrieval. In context, this makes the skill more dangerous because it is positioned as a narrow comments tool but can be used for broader content discovery and collection at scale.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The documentation exposes a full keyword-search workflow with filtering and task completion semantics, which is materially broader than single-note comment retrieval. In context, this makes the skill more dangerous because it is positioned as a narrow comments tool but can be used for broader content discovery and collection at scale.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The documentation exposes a full keyword-search workflow with filtering and task completion semantics, which is materially broader than single-note comment retrieval. In context, this makes the skill more dangerous because it is positioned as a narrow comments tool but can be used for broader content discovery and collection at scale.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The documentation exposes a full keyword-search workflow with filtering and task completion semantics, which is materially broader than single-note comment retrieval. In context, this makes the skill more dangerous because it is positioned as a narrow comments tool but can be used for broader content discovery and collection at scale.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The documentation exposes a full keyword-search workflow with filtering and task completion semantics, which is materially broader than single-note comment retrieval. In context, this makes the skill more dangerous because it is positioned as a narrow comments tool but can be used for broader content discovery and collection at scale.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The documentation exposes a full keyword-search workflow with filtering and task completion semantics, which is materially broader than single-note comment retrieval. In context, this makes the skill more dangerous because it is positioned as a narrow comments tool but can be used for broader content discovery and collection at scale.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The documentation exposes a full keyword-search workflow with filtering and task completion semantics, which is materially broader than single-note comment retrieval. In context, this makes the skill more dangerous because it is positioned as a narrow comments tool but can be used for broader content discovery and collection at scale.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The documentation exposes a full keyword-search workflow with filtering and task completion semantics, which is materially broader than single-note comment retrieval. In context, this makes the skill more dangerous because it is positioned as a narrow comments tool but can be used for broader content discovery and collection at scale.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The documentation exposes a full keyword-search workflow with filtering and task completion semantics, which is materially broader than single-note comment retrieval. In context, this makes the skill more dangerous because it is positioned as a narrow comments tool but can be used for broader content discovery and collection at scale.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documentation exposes a full keyword-search workflow with filtering and task completion semantics, which is materially broader than single-note comment retrieval. In context, this makes the skill more dangerous because it is positioned as a narrow comments tool but can be used for broader content discovery and collection at scale.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documentation exposes a full keyword-search workflow with filtering and task completion semantics, which is materially broader than single-note comment retrieval. In context, this makes the skill more dangerous because it is positioned as a narrow comments tool but can be used for broader content discovery and collection at scale.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The documentation exposes a full keyword-search workflow with filtering and task completion semantics, which is materially broader than single-note comment retrieval. In context, this makes the skill more dangerous because it is positioned as a narrow comments tool but can be used for broader content discovery and collection at scale.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The documentation exposes a full keyword-search workflow with filtering and task completion semantics, which is materially broader than single-note comment retrieval. In context, this makes the skill more dangerous because it is positioned as a narrow comments tool but can be used for broader content discovery and collection at scale.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The top-level manifest markets the skill as comment-only, but the body documents broader search, note-detail, and author-tracking features. This kind of scope deception is dangerous because it can mislead users, reviewers, and automated policy gates into granting approval for a narrower tool than what is actually shipped.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.
md
- "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.
md
- "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 261)May include surrounding context.
md
- "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 329)May include surrounding context.
md
- "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.
md
- "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.
md
- "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 272)May include surrounding context.
md
- "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 329)May include surrounding context.
md
- "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 110)May include surrounding context.
md
| 看某篇小红书笔记的评论数据 | `src/xiaohongshu/comment-cli.js` | 笔记 URL | 该笔记的评论内容、评论者信息、互动数据 |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 284)May include surrounding context.
md
| 看某篇小红书笔记的评论数据 | `src/xiaohongshu/comment-cli.js` | 笔记 URL | 该笔记的评论内容、评论者信息、互动数据 |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 329)May include surrounding context.
md
| 看某篇小红书笔记的评论数据 | `src/xiaohongshu/comment-cli.js` | 笔记 URL | 该笔记的评论内容、评论者信息、互动数据 |