T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/request.js:76- Finding
API Token Exposure Through URL Query Parameters
- Content
View full analysis
- Remediation
View remediation
Security audit
guaikei·小红书笔记·评论·博主
Security checks for vulnerabilities and agentic risk
Overview
This skill appears purpose-built for Xiaohongshu public-data research, but it handles tokens and saved results in ways users should review before installing.
Install only if you are comfortable sending Xiaohongshu keywords and URLs to guaikei.com and storing returned results locally. Treat GUAIKEI_API_TOKEN and any xsec_token URLs as sensitive; avoid running this in shared workspaces, rotate tokens if exposed, and delete or protect the logs/ directory after use.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
src/xiaohongshu/detail-cli.js:138- Finding
Access-Bearing URLs and Retrieved Data Persisted in Plaintext Logs
- Content
View full analysis
|]/g, "_") .replace(/\.\.+/g, "_") .replace(/^\.+|\.+$/g, ""); if (safeFilename.length > 200) { safeFilename = safeFilename.substring(0, 200); } if (safeFilename === "") { safeFilename = `log_${Date.now()}`; } const outputFilename = path.join( path.dirname(__filename), "..", "..", "logs", safeFilename, ); try { await fs.promises.mkdir(path.dirname(outputFilename), { recursive: true }); await fs.promises.writeFile(outputFilename, content); utils.printSuccess(` → 已保存到 ${outputFilename}`); } catch (error) ...[truncated 2381 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (50)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The description presents a multi-capability Xiaohongshu intelligence tool covering search, note details, comments, and creator works. The supplied code only covers one subset: creating and querying a task to retrieve a blogger's published notes from a URL. There is no evidence in this chunk of keyword search, note detail access, comment access, or advanced filtering/sorting/time constraints. This is therefore a description-behavior mismatch for the provided code chunk, because the declared functionality is materially broader than what the code actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description promises a specific Xiaohongshu public-content retrieval and analysis capability. However, the provided code snippet contains only static configuration values and references a domain unrelated to Xiaohongshu. There is no observable logic for searching notes, filtering/sorting results, retrieving note details or comments, or fetching a blogger's public posts. Because the visible code’s purpose is generic configuration and its referenced resource is inconsistent with the declared target platform, this is a clear description-to-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明描述的是一个面向小红书内容数据采集与分析触发的技能，核心能力应涉及访问小红书公开数据、执行搜索、读取笔记详情/评论、抓取博主作品等。实际代码却只是一个独立的通用参数解析模块（parseArgs/readValueAfterFlag/buildHelp），用于处理 CLI 输入与帮助信息生成。它既没有网络访问，也没有任何与小红书、内容搜索、评论、博主数据相关的实现。因此该代码片段的实际行为与声明用途存在明显且实质性的偏差。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description describes a network/data-retrieval skill focused on Xiaohongshu content search and analysis. The actual code chunk does not implement any of those behaviors. Instead, it performs local file I/O by creating a logs directory path and writing provided content to a file. This is a materially different primary purpose and introduces an undeclared capability: writing to the local filesystem. While logging can be a supporting detail in some systems, this chunk itself is solely a logging helper and shows none of the declared platform-specific retrieval functionality, so the description does not accurately represent the supplied code.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description describes a full-featured Xiaohongshu content acquisition and analysis skill. However, the supplied code chunk contains only a utility function that reads package.json from the local filesystem and returns its name field. This behavior is materially different from the declared purpose and does not implement any of the stated external data retrieval capabilities. While this may be a supporting utility within a larger project, based on the supplied code chunk alone, the behavior does not match the declared description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description presents a full Xiaohongshu content retrieval and analysis-enabling skill. However, the supplied code chunk contains only helper functions for URL normalization and classification (
normalizeUrl,isNoteUrl,isProfileUrl) plus a utility to convert URLs into a name string (url2Name). It does not perform network requests, search, scraping, comment retrieval, profile-content retrieval, sorting, filtering, or any structured data return. This is a material description-behavior mismatch: the actual code is only a small URL utility, not the described Xiaohongshu search/data acquisition capability.- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | 看某篇笔记的详情+评论 | `src/xiaohongshu/detail-cli.js` | 笔记 URL | `explore/` 或短链 |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | 看某篇笔记的详情+评论 | `src/xiaohongshu/detail-cli.js` | 笔记 URL | `explore/` 或短链 |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | 看某篇笔记的详情+评论 | `src/xiaohongshu/detail-cli.js` | 笔记 URL | `explore/` 或短链 |
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 76% confidence
- Finding
The skill declares use of an environment secret (
GUAIKEI_API_TOKEN) but does not declare an explicit tool permission/scope boundary. That weakens least-privilege controls and makes it harder for a host to reason about what sensitive capabilities the skill needs. In this context the risk is increased because the skill sends user queries to a third-party API, so secret use should be tightly scoped and transparent.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
The manifest description is entirely written to operate in Chinese and targets Chinese-language Xiaohongshu workflows, but it does not indicate that language is optional or user-selectable. Under the stated policy, forcing a specific language or locale without opt-in can be a natural-language policy violation unless the constraint is clearly documented and justified.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill presents itself as a data-retrieval integration but documents automatic writing of execution results to
logs/. That expands data handling beyond what users may expect and can persist sensitive queries, Xiaohongshu links, fetched content, and derived metadata on disk where other local users/processes may access them.- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Automatic archival of each execution to
logs/can retain user-provided URLs, search terms, fetched content, and possibly operational metadata without consent or minimization. In this skill's context, that is more dangerous because the data may reveal market research interests, monitored creators, or customer/competitor intelligence, creating privacy and business confidentiality exposure.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill does not prominently warn users that supplied keywords and links are sent to a third-party API and that results are also saved locally. This creates a privacy and data-governance risk because users may unknowingly disclose research targets, competitor monitoring subjects, or content URLs to an external service and local storage.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This markdown file is entirely written in Chinese, including the title and all user-facing change descriptions, with no indication that another language is available or that the skill is intentionally limited to a Chinese-speaking or region-specific audience. Under the policy, forcing a specific language without user opt-in or clear justification is a natural-language policy violation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill explicitly instructs users to retrieve public note comments and creator post data at scale, including up to 10,000 structured records, but provides no guidance on privacy, minimization, retention, or downstream handling. Even if the source content is publicly accessible, large-scale collection, aggregation, and analysis of comments and creator activity can create privacy, profiling, and compliance risks, especially when used for KOL screening, competitor monitoring, or sentiment analysis.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This function sends an API token and a user-provided note URL to a remote endpoint via
postJson, which is a data-transmitting network operation. While the comments describe parameters, there is no confirmation prompt, user-facing disclosure, or warning in the code about transmitting potentially sensitive data off-system.- Content
Static analysis
No suspicious patterns detected.