T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/request.js:76- Finding
API Credential Exposed in URL Query Strings
- Content
View full analysis
- Remediation
View remediation
Security audit
guaikei-xhs-comment-grabber
Security checks for vulnerabilities and agentic risk
Overview
The skill largely matches its Xiaohongshu public-data purpose, but it handles the required API token in a risky way and automatically stores fetched results locally.
Install only if you are comfortable sending Xiaohongshu keywords or URLs, returned public social data, and a GUAIKEI_API_TOKEN to guaikei.com. Use a scoped or disposable token if possible, rotate any token already used with this version, and review or delete the local logs directory when results may contain sensitive public comments or business research.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (68)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The description promises a skill for assessing a Xiaohongshu blogger's real engagement level using true like/comment/favorite counts across public works or single notes. The actual code chunk is limited to a comment module: it submits a comment scraping task for a note URL and fetches the resulting comment list. While comments are related to the declared domain, the implemented behavior is materially narrower and does not support the main declared purpose of engagement-quality evaluation based on multiple interaction metrics. There is no code here for likes, favorites, creator-wide work analysis, or any assessment logic for detecting inflated data. Therefore this is a meaningful description-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
声明的核心能力是评估某个小红书博主或单篇笔记的真实互动水平，重点在点赞/评论/收藏数据的获取与质量判断；而实际代码仅是一个“笔记搜索模块”，通过关键词调用搜索接口并整理结果链接。代码没有显示按博主聚合作品、提取互动指标、分析注水/真实性，或专门服务于KOL合作评估。因此其主要目的与声明存在实质性偏差。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明描述的是一个面向小红书博主互动数据获取与分析的业务技能，但提供的代码仅为通用参数解析与帮助文本生成模块。该代码没有访问小红书、没有网络请求、没有处理博主/笔记数据、没有任何互动指标计算逻辑。虽然 CLI 参数解析可作为配套基础设施，但当前代码块本身的实际功能与声明的核心用途明显不一致，因此应判定为描述与行为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
根据提供的代码片段，其唯一明确行为是管理和校验API TOKEN，并在TOKEN无效时输出联系微信获取私有TOKEN的提示。这与声明中描述的核心能力——获取小红书博主公开作品及单篇笔记的真实互动数据并评估互动质量——没有直接对应关系。虽然TOKEN管理可能是某类技能的辅助实现细节，但当前给出的代码片段完全未体现声明的主要业务功能，反而突出了一项未声明的获客/获取私有TOKEN提示行为。因此就该代码片段与声明的一致性而言，存在明显不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
声明描述的是一个面向小红书数据抓取与互动分析的技能，但提供的代码片段并未体现任何与小红书、博主作品、点赞评论收藏数据获取或互动质量评估相关的行为。实际代码的主要功能是向本地文件系统写入日志文件，这属于与声明目的无关的能力。虽然日志功能可能作为配套实现存在，但当前代码片段本身无法支持所宣称的核心用途，因此描述与实际行为存在明显不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared purpose is a Xiaohongshu analytics skill for evaluating real engagement on public posts. However, the supplied code chunk is merely a helper that reads package.json from the local filesystem and returns the package name. This is materially unrelated to the declared functionality and shows no implementation of data retrieval, metric extraction, or engagement assessment. Therefore, the description does not accurately represent the actual behavior of the provided code.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description is about a data-analysis skill for Xiaohongshu public post metrics, but the supplied code chunk only contains utility functions for printing a banner and log messages. This is not merely a supporting detail in context, because the visible code has no evidence of the stated core behavior: no network access, no parsing, no metric collection, and no analysis logic. Therefore the supplied code chunk does not accurately represent the declared purpose.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
该代码片段的核心作用是输入验证和参数规范化：检查关键词长度、过滤特殊字符、禁止http链接、清洗关键词字符集，并校正搜索参数取值范围。这属于通用搜索前置处理逻辑。相比之下，声明描述的是一个面向小红书KOL分析的数据采集与评估技能，重点应包括访问公开作品/笔记、提取真实互动数据并进行分析。当前代码完全没有显示这些能力，因此其实际行为与声明的主要用途存在明显且实质性的偏差。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared description promises a skill for obtaining public Xiaohongshu post/account engagement data and assessing creator interaction quality. However, the supplied code chunk contains only helper functions for URL normalization, URL type checking (note vs. profile), and generating a filename-like identifier from a URL. This is only a supporting input-validation utility and does not implement the core described capability. Because the actual code behavior is materially narrower and different from the declared primary purpose, this is a mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
声明强调的是获取小红书博主公开作品及单篇笔记的真实点赞/评论/收藏数据，以评估整体互动质量；但这段代码仅处理单个笔记 URL，并通过 comment.createCommentTask / getCommentTask 获取评论相关结果。代码中没有任何点赞数、收藏数、博主作品列表、博主维度汇总分析或互动质量评估逻辑。虽然“单篇笔记评论数据”与声明中的一部分相关，但整体主功能明显更窄，且遗漏了声明中的关键能力，因此属于描述与实际行为不一致。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
声明的核心用途是评估某个小红书博主或其单篇笔记的真实互动水平，重点在博主维度、互动指标提取和质量判断。但这段代码的行为是通用关键词搜索CLI：解析搜索参数，校验和清洗关键词，调用 search.createSearchTask / getSearchTask 执行内容搜索，并输出搜索结果。代码中没有看到按博主ID/主页抓取公开作品、提取点赞评论收藏数据、汇总博主整体互动表现，或进行“是否注水/互动质量”判断的逻辑。因此其主要目的与声明存在明显偏差，属于描述与实际行为不符。
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | 看某篇小红书笔记的评论数据 | `src/xiaohongshu/comment-cli.js` | 笔记 URL | 该笔记的评论内容、评论者信息、互动数据 |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | 看某篇小红书笔记的评论数据 | `src/xiaohongshu/comment-cli.js` | 笔记 URL | 该笔记的评论内容、评论者信息、互动数据 |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | 看某篇小红书笔记的评论数据 | `src/xiaohongshu/comment-cli.js` | 笔记 URL | 该笔记的评论内容、评论者信息、互动数据 |
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill declares required environment variables and discusses external API access, but it does not define any explicit tool/permission scope such as allowed tools or execution boundaries. In an agent environment, this can lead to over-broad execution privileges, making it easier for the skill to access environment secrets or invoke capabilities beyond what users expect.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest says this skill is for obtaining public Xiaohongshu works and per-note real like/comment/favorite data to assess engagement quality, and explicitly says it is not for follower estimation or backend data. In contrast, the package description and keywords claim broader functions such as mining viral notes, monitoring competitors, market research, trend monitoring, user profiling, and driving account growth, which materially exceeds the stated skill purpose.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The description and keywords are entirely in Chinese, indicating the skill is presented in a single language without any opt-in or alternative locale. Under the policy, forcing a specific language without user choice can be a natural-language policy violation unless the locale constraint is explicitly justified.
- Content