guaikei-xhs-check-blogger

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:04 AM UTC
• Version: 1.0.0

Overview

This skill performs the advertised Xiaohongshu data collection, but it handles credentials and saved results in ways users should review carefully before installing.

Install only if you are comfortable sending Xiaohongshu keywords, target URLs, and your Guaikei API token to www.guaikei.com. Treat GUAIKEI_API_TOKEN as a secret, avoid printing it with echo, and regularly delete or protect the generated logs/ files because they may contain target links, xsec_token values, comments, author metadata, and business research results.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: src/utils/request.js:86

Finding

API Credential Exposed Through URL Query Parameters

Content

View full analysis

``` TLS protects the request while it is in transit, but it does not prevent the URL from being recorded at either endpoint. Query strings are commonly retained in web-server access logs, reverse-proxy logs, application performance monitoring systems, request traces, debugging tools, and infrastructure telemetry. The polling workflow increases expos ...[truncated 1307 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: src/xiaohongshu/detail-cli.js:142

Finding

Capability-Bearing URLs and Retrieved Data Persisted in Plaintext

Content

View full analysis

?xsec_token= ``` The logging implementation writes the complete serialized output without redaction or explicit restrictive permissions: ```js // src/utils/log.js:24-35 const outputFilename = path.join( path.dirname(__filename), "..", "..", "logs", safeFilename, ); try { await fs.promises.mkdir(path.dirname(outputFilename), { recursive: true }); await fs.promises.writeFile(outputFilename, content); utils.printSuccess(` → 已保存到 ${outputFilename}`); } catch (error) { utils.printError(`日志写入失败: ${error.message}`); } ``` Equivalent automatic persistence is performed at: - `src/xiaohongshu/comment-cli.js:151-160` - `src/xiaohongshu/post-cli.js:153-162` - `src/xiaohongshu/search-cli.js:180-210` ### Technical Analysis Successful CLI output is automatically serialized and written under the project-level `logs/` directory. For URL-based operations, `finalOutput.reques ...[truncated 2296 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (71)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

This finding identifies a narrower but real issue: the skill advertises keyword-search-oriented discovery, yet the documented input space also includes blogger-profile URLs, which changes both what data can be collected and the operational scope. That discrepancy matters because profile monitoring is a more targeted surveillance-like activity than generic trend search.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This finding identifies a narrower but real issue: the skill advertises keyword-search-oriented discovery, yet the documented input space also includes blogger-profile URLs, which changes both what data can be collected and the operational scope. That discrepancy matters because profile monitoring is a more targeted surveillance-like activity than generic trend search.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This finding identifies a narrower but real issue: the skill advertises keyword-search-oriented discovery, yet the documented input space also includes blogger-profile URLs, which changes both what data can be collected and the operational scope. That discrepancy matters because profile monitoring is a more targeted surveillance-like activity than generic trend search.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This finding identifies a narrower but real issue: the skill advertises keyword-search-oriented discovery, yet the documented input space also includes blogger-profile URLs, which changes both what data can be collected and the operational scope. That discrepancy matters because profile monitoring is a more targeted surveillance-like activity than generic trend search.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This finding identifies a narrower but real issue: the skill advertises keyword-search-oriented discovery, yet the documented input space also includes blogger-profile URLs, which changes both what data can be collected and the operational scope. That discrepancy matters because profile monitoring is a more targeted surveillance-like activity than generic trend search.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This finding identifies a narrower but real issue: the skill advertises keyword-search-oriented discovery, yet the documented input space also includes blogger-profile URLs, which changes both what data can be collected and the operational scope. That discrepancy matters because profile monitoring is a more targeted surveillance-like activity than generic trend search.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This finding identifies a narrower but real issue: the skill advertises keyword-search-oriented discovery, yet the documented input space also includes blogger-profile URLs, which changes both what data can be collected and the operational scope. That discrepancy matters because profile monitoring is a more targeted surveillance-like activity than generic trend search.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This finding identifies a narrower but real issue: the skill advertises keyword-search-oriented discovery, yet the documented input space also includes blogger-profile URLs, which changes both what data can be collected and the operational scope. That discrepancy matters because profile monitoring is a more targeted surveillance-like activity than generic trend search.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This finding identifies a narrower but real issue: the skill advertises keyword-search-oriented discovery, yet the documented input space also includes blogger-profile URLs, which changes both what data can be collected and the operational scope. That discrepancy matters because profile monitoring is a more targeted surveillance-like activity than generic trend search.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This finding identifies a narrower but real issue: the skill advertises keyword-search-oriented discovery, yet the documented input space also includes blogger-profile URLs, which changes both what data can be collected and the operational scope. That discrepancy matters because profile monitoring is a more targeted surveillance-like activity than generic trend search.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This finding identifies a narrower but real issue: the skill advertises keyword-search-oriented discovery, yet the documented input space also includes blogger-profile URLs, which changes both what data can be collected and the operational scope. That discrepancy matters because profile monitoring is a more targeted surveillance-like activity than generic trend search.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

md

- "分析这条小红书笔记评论区的主要观点: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

md

- "分析这条小红书笔记评论区的主要观点: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

md

- "分析这条小红书笔记评论区的主要观点: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.

md

- "分析这条小红书笔记评论区的主要观点: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.

md

- "分析这条小红书笔记评论区的主要观点: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

md

- "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

md

- "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.

md

- "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 152)May include surrounding context.

md

- "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

md

- "只拉这条笔记的评论数据做观点归纳: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

md

- "只拉这条笔记的评论数据做观点归纳: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

md

- "只拉这条笔记的评论数据做观点归纳: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.

md

- "只拉这条笔记的评论数据做观点归纳: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 155)May include surrounding context.

md

- "只拉这条笔记的评论数据做观点归纳: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:16