T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/request.js:69- Finding
API Credentials and Access-Bearing URLs Are Transmitted in Query Strings
- Content
View full analysis
- Remediation
View remediation
Security audit
guaikei-xhs-blogger-list
Security checks for vulnerabilities and agentic risk
Overview
The skill appears to perform the advertised Xiaohongshu data collection, but it handles API tokens and saved results in ways users should review before installing.
Install only if you are comfortable sending Xiaohongshu keywords, URLs, and your Guaikei API token to the Guaikei service. Treat generated logs as sensitive: review or delete the logs/ directory after use, avoid committing it, and avoid passing URLs containing reusable tokens unless necessary.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/log.js:5- Finding
Retrieved Data and Token-Bearing Request URLs Are Automatically Persisted in Plaintext
- Content
View full analysis
|]/g, "_") .replace(/\.\.+/g, "_") .replace(/^\.+|\.+$/g, ""); if (safeFilename.length > 200) { safeFilename = safeFilename.substring(0, 200); } if (safeFilename === "") { safeFilename = `log_${Date.now()}`; } const outputFilename = path.join( path.dirname(__filename), "..", "..", "logs", safeFilename, ); try { await fs.promises.mkdir(path.dirname(outputFilename), { recursive: ...[truncated 3156 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (75)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill is described as 'latest-sorted recent note retrieval,' but the documented search interface allows multiple sort modes, broader time windows, and possible local result logging. While not inherently malicious, this means the actual data collection and retention scope is broader than the user-facing summary suggests.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill is described as 'latest-sorted recent note retrieval,' but the documented search interface allows multiple sort modes, broader time windows, and possible local result logging. While not inherently malicious, this means the actual data collection and retention scope is broader than the user-facing summary suggests.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill is described as 'latest-sorted recent note retrieval,' but the documented search interface allows multiple sort modes, broader time windows, and possible local result logging. While not inherently malicious, this means the actual data collection and retention scope is broader than the user-facing summary suggests.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill is described as 'latest-sorted recent note retrieval,' but the documented search interface allows multiple sort modes, broader time windows, and possible local result logging. While not inherently malicious, this means the actual data collection and retention scope is broader than the user-facing summary suggests.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill is described as 'latest-sorted recent note retrieval,' but the documented search interface allows multiple sort modes, broader time windows, and possible local result logging. While not inherently malicious, this means the actual data collection and retention scope is broader than the user-facing summary suggests.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill is described as 'latest-sorted recent note retrieval,' but the documented search interface allows multiple sort modes, broader time windows, and possible local result logging. While not inherently malicious, this means the actual data collection and retention scope is broader than the user-facing summary suggests.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill is described as 'latest-sorted recent note retrieval,' but the documented search interface allows multiple sort modes, broader time windows, and possible local result logging. While not inherently malicious, this means the actual data collection and retention scope is broader than the user-facing summary suggests.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill is described as 'latest-sorted recent note retrieval,' but the documented search interface allows multiple sort modes, broader time windows, and possible local result logging. While not inherently malicious, this means the actual data collection and retention scope is broader than the user-facing summary suggests.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill is described as 'latest-sorted recent note retrieval,' but the documented search interface allows multiple sort modes, broader time windows, and possible local result logging. While not inherently malicious, this means the actual data collection and retention scope is broader than the user-facing summary suggests.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill is described as 'latest-sorted recent note retrieval,' but the documented search interface allows multiple sort modes, broader time windows, and possible local result logging. While not inherently malicious, this means the actual data collection and retention scope is broader than the user-facing summary suggests.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill is described as 'latest-sorted recent note retrieval,' but the documented search interface allows multiple sort modes, broader time windows, and possible local result logging. While not inherently malicious, this means the actual data collection and retention scope is broader than the user-facing summary suggests.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill is described as 'latest-sorted recent note retrieval,' but the documented search interface allows multiple sort modes, broader time windows, and possible local result logging. While not inherently malicious, this means the actual data collection and retention scope is broader than the user-facing summary suggests.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill is described as 'latest-sorted recent note retrieval,' but the documented search interface allows multiple sort modes, broader time windows, and possible local result logging. While not inherently malicious, this means the actual data collection and retention scope is broader than the user-facing summary suggests.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 89% confidence
- Finding
The skill is described as 'latest-sorted recent note retrieval,' but the documented search interface allows multiple sort modes, broader time windows, and possible local result logging. While not inherently malicious, this means the actual data collection and retention scope is broader than the user-facing summary suggests.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "只拉这条笔记的评论数据做观点归纳: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "只拉这条笔记的评论数据做观点归纳: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Static analysis
Detected: suspicious.exposed_secret_literal
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- SKILL.md:16