T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/request.js:76- Finding
API Credential Exposed in URL Query Strings
- Content
View full analysis
- Remediation
View remediation
Security audit
guaikei·小红书扒评论看舆情
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent Xiaohongshu public-data CLI, with privacy and token-handling cautions but no evidence of hidden or destructive behavior.
Install only if you are comfortable sending Xiaohongshu links, keywords, and your Guaikei API token to www.guaikei.com. Treat generated logs as sensitive because they may include research targets, returned content, and xsec_token-bearing URLs; delete or protect the logs directory as needed and rotate the API token if exposure is suspected.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
src/utils/log.js:5- Finding
Automatic Plaintext Persistence of Sensitive Request and Result Data
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (44)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 87% confidence
- Finding
The declaration is narrowly scoped to public Xiaohongshu data operations. However, the only observable code is a constants file pointing to www.guaikei.com, which is not a Xiaohongshu domain, and contains only generic request/retry settings. While config alone is limited evidence and does not prove full behavior, it is inconsistent with the declared resource scope and does not substantiate the claimed Xiaohongshu-only functionality. Therefore this chunk is best assessed as a mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明描述的是一个面向小红书公开数据处理的专用技能，而代码片段实现的只是通用参数解析与帮助文档生成工具。该代码既没有体现小红书平台限定，也没有任何网络请求、平台数据读取、笔记/评论/博主内容处理能力。虽然这类工具代码可能作为技能的辅助模块存在，但就所提供代码块本身而言，其实际行为与声明的核心用途明显不一致，因此应判定为描述与代码行为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description is narrowly scoped to Xiaohongshu public-data retrieval features. The actual code chunk does not perform any Xiaohongshu-specific network access, search, scraping, or content handling. Instead, it provides a general-purpose local file logging capability using fs.promises.mkdir and fs.promises.writeFile. This is a materially different behavior and uses local filesystem resources that are not reflected in the description or permissions. While logging can be a supporting detail in some skills, this chunk itself is entirely unrelated to the declared Xiaohongshu-only functionality, so it constitutes a mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description says this skill is for operating on public Xiaohongshu content. However, the supplied code does not implement any Xiaohongshu-related functionality at all. Instead, it accesses the local filesystem, opens package.json, parses it, and returns the package name. This is a materially different behavior from the declared purpose. While helper utilities can be acceptable, this chunk's observable purpose is unrelated to Xiaohongshu data processing, so based on the supplied code alone, the description does not accurately represent the code behavior.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这篇爆款笔记的详情和互动数据: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy'"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这篇爆款笔记的详情和互动数据: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy'"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这篇爆款笔记的详情和互动数据: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy'"
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 84% confidence
- Finding
The skill declares use of a sensitive environment variable (
GUAIKEI_API_TOKEN) but does not define an explicit tool scope such aspermissionsorallowed-tools. That omission weakens least-privilege guarantees and makes it harder for a host system to constrain when secrets are exposed or which capabilities the skill actually needs.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill sends user-provided keywords and Xiaohongshu links to a third-party service but does not prominently warn users before collection or transmission occurs. This creates a privacy and data-governance risk, especially when links or search terms may contain sensitive business research targets, identifiers, or tracking parameters.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown file uses Chinese as the sole language in its user-facing title and continues that pattern throughout the changelog. Under the policy, forcing a specific language without user opt-in or justification is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The entire skill-facing documentation, examples, and invocation guidance are written exclusively in Chinese, with no indication that other languages are supported or that the user can opt into a preferred locale. Under the language/locale policy, a skill should not implicitly require a specific language unless that constraint is clearly documented and justified or the user is given a choice.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The function sends a token and note URL to an external API via postJson, which is a privacy-relevant network operation. Although comments describe parameters, there is no user-facing confirmation, warning, or disclosure in the code indicating that these values will be transmitted off-process.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This request transmits the API token, URL, and query parameters to a remote endpoint. The code includes retry error logging, but no user-facing notice that sensitive or user-supplied data is being sent over the network.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The natural-language comments and API parameter descriptions are entirely in Chinese, with no indication that the skill is region-specific or that language choice is optional. Per the policy, forcing a specific language without user opt-in or clear justification is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This code emits all user-facing warning and informational text only in Chinese, including operational guidance and support instructions. That creates a locale-policy issue because the skill imposes a specific language on users without any visible opt-in or alternative language path.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This code contains user-facing error strings in Chinese and later a success message in Chinese, which imposes a specific language on users. The policy allows locale constraints only when users are given a choice or the restriction is clearly documented and justified, neither of which is evident in this file.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The success and failure messages shown to users are hard-coded in Chinese, continuing the same language-only behavior. Forcing a single locale in user-visible text is a natural-language policy issue unless the tool explicitly offers a language choice or documents a justified regional scope.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This code file defines reusable GET and POST helpers that send caller-supplied params and data to a remote host via HTTPS, but it provides no confirmation prompt, user-facing log, or explanatory comment/docstring disclosing that user or system data may be transmitted externally. Under the code-file criteria for SQP-2, network calls that transmit data should have some visible disclosure unless clearly covered elsewhere.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The module comment and banner text are in Chinese, and the banner shown to users is hard-coded as Chinese-only output. This creates a language/locale policy concern because the skill imposes a specific language in user-facing messaging without any opt-in, fallback, or documented regional justification.
- Content