T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/request.js:76- Finding
API Credential Exposed in URL Query Strings
- Content
View full analysis
- Remediation
View remediation
Security audit
guaikei·小红书竞品内容获取
Security checks for vulnerabilities and agentic risk
Overview
The skill appears purpose-aligned for Xiaohongshu data retrieval, but it should be reviewed because it sends credentials and links to a third-party API and automatically saves retrieved data locally in plaintext.
Install only if you are comfortable sending Xiaohongshu keywords/links and your GUAIKEI_API_TOKEN to guaikei.com. Treat generated logs as sensitive: review, delete, or protect the logs directory, avoid committing it, and rotate the API token if it may have been exposed through request logs or saved artifacts.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
src/xiaohongshu/detail-cli.js:138- Finding
Capability-Bearing URLs and Retrieved Data Persisted in Plaintext Logs
- Content
View full analysis
|]/g, "_") .replace(/\.\.+/g, "_") .replace(/^\.+|\.+$/g, ""); if (safeFilename.length > 200) { safeFilename = safeFilename.substring(0, 200); } if (safeFilename === "") { safeFilename = `log_${Date.now()}`; } const outputFilename = path.join( path.dirname(__filename), "..", "..", "logs", safeFilename, ); try { await fs.promises.mkdir(path.dirname(outputFilena ...[truncated 3211 chars]- Remediation
View remediation
` or `--save`. 2. Redact sensitive query parameters before printing or saving URLs. At minimum, remove or replace `xsec_token`, `token`, and similarly named credentials. 3. Recursively sanitize returned objects before serialization because sensitive URLs can occur inside nested result records. 4. When persistence is explicitly requested, create files with owner-only permissions: ```js await fs.promises.writeFile(outputFilename, sanitizedContent, { mode: 0o600, flag: "wx", }); ``` 5. Create the log directory with restrictive permissions and verify that existing directories are not broadly writable or readable. 6. Add retention controls, such as automatic expiry or deletion, and document where records are stored. 7. Add `logs/` to `.gitignore` and exclude it from default CI artifacts, backups, diagnostic bundles, and package publication. 8. Avoid including full source URLs in normal structured output when resource identifiers are sufficient. 9. Clearly disclose persistent storage behavior and obtain user consent before saving collected third-party data. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (49)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
The code chunk specifically supports one subset of the declared behavior: retrieving a blogger's published notes/works from a Xiaohongshu blogger URL. It does not show functionality for searching notes, fetching note details, or retrieving comments. Since the declared description presents a broader capability set than what this code chunk actually does, there is a description-behavior mismatch for this chunk. There is no evidence of unrelated or dangerous extra capability; the mismatch is that the implementation is materially narrower than the declared purpose.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
该代码块的实际功能是调用小红书笔记搜索相关接口：创建关键词搜索任务、查询搜索结果，并为结果项拼接笔记链接和用户主页链接。这与声明中的“搜小红书笔记”部分一致。但声明还包含“看笔记详情、查笔记评论、查博主作品”等更广泛能力，而在提供的代码块中没有相应接口调用或处理逻辑。因此该代码块相对于声明是能力不足/描述过宽，属于描述与行为不完全一致。未发现额外的未声明高风险能力；问题主要是声明覆盖范围明显大于当前代码实际实现范围。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared purpose is narrowly focused on retrieving Xiaohongshu notes, comments, and creator content. However, the supplied code only contains generic configuration constants and points to a base URL on www.guaikei.com, which does not match the declared Xiaohongshu-only scope. While configuration by itself is not a capability, the explicit target domain is inconsistent with the description, and the chunk provides no evidence of the promised Xiaohongshu functionality. Therefore this is a description-behavior mismatch based on inconsistent resource targeting and absence of matching behavior in the provided code.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明描述的是一个面向小红书内容检索与数据读取的技能，但提供的代码片段没有任何与小红书、网络请求、链接解析、笔记/评论/博主数据访问相关的实现。相反，这段代码的实际作用是通用 CLI 参数处理工具，属于底层辅助模块，主功能与声明用途 materially 不同。因此这是明显的描述与行为不一致。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
声明描述的是一个面向小红书内容检索与数据获取的技能，而提供的代码片段实际只是通用日志写入模块，没有任何小红书相关网络请求、链接解析、数据抓取、评论查询或博主作品查询逻辑。虽然日志记录可作为辅助实现细节，但当前代码片段本身展示的核心行为是本地文件写入，这与声明的主要用途明显不一致，因此应判定为描述与行为不匹配。
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "拉这条笔记的评论做观点聚类: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "拉这条笔记的评论做观点聚类: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "拉这条笔记的评论做观点聚类: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 84% confidence
- Finding
The manifest declares use of a sensitive capability via environment variables (
GUAIKEI_API_TOKEN) but does not constrain tool scope with explicit permissions or allowed-tools metadata. That creates unnecessary ambiguity about what the skill may access at runtime and weakens least-privilege controls, especially because the skill brokers data to a third-party API.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The activation text is very broad: it says to use the skill whenever a user mentions Xiaohongshu and wants to understand content, even if they do not explicitly ask for data retrieval. Over-broad triggering can cause the agent to invoke a third-party data-access skill unnecessarily, leading to unintended data externalization, user surprise, and expanded attack surface from prompt-routing manipulation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
Automatically saving task results to a local logs/ directory can create unintended data retention, especially when outputs include scraped notes, comments, creator identifiers, or query history. Even if the source data is public, silent persistence increases exposure to local disclosure, over-collection, and accidental reuse beyond the user’s expectations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The document explicitly supports collecting and analyzing Xiaohongshu note comments, which are third-party user-generated data, but provides no privacy notice, lawful-use guidance, or data-handling constraints. In a competitor-analysis skill, this increases the risk that operators will process personal data at scale without considering consent, retention, minimization, or platform-policy restrictions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The document instructs users to configure GUAIKEI_API_TOKEN before execution but does not disclose how that credential is used or that note/comment/profile data may be sent to an external service. This creates a transparency and credential-handling risk: users may provide tokens and process third-party data without understanding external transmission, trust boundaries, or the need to protect secrets.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This code sends an API token and user-provided note URL to a remote endpoint via postJson, but the file provides only developer-oriented docstrings and no user-facing disclosure, confirmation, or notice about the network transmission. Under the code-file criteria, network calls that transmit user or system data should be flagged when there is no visible warning in the code and no README/SKILL.md context is available here.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This function performs a network request that includes the API token and user-supplied URL as request parameters, but there is no visible user disclosure, prompt, or warning in the file about sending that data off-system. The existing retry error logging is operational logging only and does not inform the user about the data transmission itself.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This code sends the provided API token as part of an HTTP request, which is a safety-relevant network operation involving credentials. While the function comments describe parameters, they do not warn users that the token will be transmitted to a remote API, and there is no confirmation or other user-facing disclosure in the file.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The module posts the user-supplied note URL and later submits URL and limit values to remote endpoints, which can affect user privacy because user-provided data is transmitted over the network. The file contains no explicit warning or disclosure that these inputs are sent to an external service beyond ordinary parameter docstrings.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The user-facing strings at L22-L25 are entirely in Chinese and instruct the user how to proceed, with no indication that other languages are supported or that Chinese is a justified locale requirement. This is a natural-language policy concern because the skill imposes a specific language on users without opt-in.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest describes a skill for searching Xiaohongshu notes, viewing note details, comments, and creator posts, which is a read-oriented data retrieval scope. This utility creates directories and writes provided content to local files under a logs directory, which is not an obvious or necessary end-user capability for that stated purpose.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Multiple error messages are presented only in Chinese, including validation and authentication failures, which forces a specific language on users without opt-in or explanation. This matches the language/locale policy violation category because the file does not offer a language choice or justify a locale-specific constraint.
- Content