T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/request.js:79- Finding
API Credential and Sensitive Request Data Exposed in URL Query Strings
- Content
View full analysis
- Remediation
View remediation
Security audit
guaikei-xhs-content-research
Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed Xiaohongshu public-content research tool, but users should understand that it sends requests through Guaikei and saves full results locally.
Install only if you are comfortable sending Xiaohongshu research keywords, target links, and your Guaikei API token to www.guaikei.com. Run it in a private workspace, protect or periodically delete the logs directory, and rotate the API token if you suspect command output or logs were exposed.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
src/utils/log.js:5- Finding
Automatic Persistence of Complete Results Without Restrictive File Permissions or Redaction
- Content
View full analysis
|]/g, "_") .replace(/\.\.+/g, "_") .replace(/^\.+|\.+$/g, ""); if (safeFilename.length > 200) { safeFilename = safeFilename.substring(0, 200); } if (safeFilename === "") { safeFilename = `log_${Date.now()}`; } const outputFilename = path.join( path.dirname(__filename), "..", "..", "logs", safeFilename, ); try { await fs.promises.mkdir(path.dirname(outputFilename), { recursive: true }); await fs.promises.writeFile(outputFilename, content); utils.printSuccess(`Saved to ${outputFilename}`); } catch (error) { utils.printError(`Log write failed: ${error.message}`); } } ``` Every successful command passes the complete output object to this function: ```js await log.taskWrite( `${startTime}_${validator.url2Name(url)}_detail.json`, JSON.stringify(finalOutput, null, 2), ); ``` Returned data may contain access-bearing Xiaohongshu URLs constructed by the API modules: ```js if (res.data.id && res.data.xsec_token) { res.data.url = "https://www.xiaohongshu.com/explore/" + res.data.id + "?xsec_token=" + res.data.xsec_token; } if (res.data.user && res.data.user.user_id && res.data.user.xsec_token) { res.data.user.url = "https://www.xiaohongshu.com/user/profil ...[truncated 2874 chars]- Remediation
View remediation
` or `--save` option. 2. Create the log directory with owner-only permissions: ```js await fs.promises.mkdir(logDirectory, { recursive: true, mode: 0o700, }); ``` 3. Create result files with owner-only permissions and avoid silently overwriting existing files: ```js await fs.promises.writeFile(outputFilename, redactedContent, { mode: 0o600, flag: "wx", }); ``` 4. Remove or mask `xsec_token`, API credentials, and other access-bearing query parameters before serialization. 5. Allow users to choose whether comments, profile fields, request URLs, and execution metadata are included in saved output. 6. Define and document a retention period, and provide a cleanup command or automatic expiration mechanism. 7. Exclude `logs/` from version control, package publication, CI artifacts, telemetry collection, and general-purpose backups unless explicitly required. 8. Warn users when saving potentially sensitive data in shared or multi-user environments. 9. Add tests that verify restrictive permissions and confirm that stored results do not contain API tokens or unredacted access-bearing query parameters. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (53)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明描述的是面向小红书创作的数据获取/参考类能力，应涉及小红书内容检索、热门数据分析或竞品风格提取等行为。但提供的代码仅是底层通用工具模块，负责解析命令行参数和生成帮助文档，没有任何与小红书数据、内容分析、创作参考、笔记/评论抓取相关的逻辑。其主要目的与声明的业务用途明显不一致，因此构成描述与实际行为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
声明的核心能力是提供小红书爆款参考数据与创作灵感依据，但实际代码片段只负责本地TOKEN格式校验和提示信息输出，主要用途是鉴权/配置检查。它没有展示与小红书相关的数据访问、热门内容查询、评论分析、竞品风格提取等行为，因此代码行为与描述的主要目的存在明显不一致。这不是单纯的底层支持细节，因为当前片段唯一可见功能与声明的业务能力完全不同。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明描述的是一个面向小红书内容分析/参考数据获取的能力，但给出的代码块并未体现任何与小红书数据抓取、热门内容分析、评论收集、竞品风格分析或创作参考相关的行为。相反，它执行的是本地日志文件写入这一通用工具功能，并且涉及文件系统访问，而声明权限为空、用途中也未提及本地文件写入。这不是单纯的支持性细节，因为当前代码块本身的主要功能与声明用途完全不同。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
声明描述的是一个面向小红书创作的数据参考技能，核心能力应包括获取或整理高赞笔记、热门评论、竞品风格等真实内容数据。但提供的代码只实现了一个工具函数：读取本地 package.json 并返回包名。这与声明的主要用途完全不一致。虽然读取本地配置文件本身不一定敏感，也可视为某些技能的辅助实现，但在当前代码片段中看不到任何与小红书数据、内容分析、选题支持或创作灵感参考相关的行为，因此应判定为明显不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
声明描述的是一个面向小红书内容创作的数据参考技能，核心应涉及内容检索、数据采集、分析或返回参考信息。但给出的代码片段只是底层通用重试工具，没有任何与小红书、选题、爆款笔记、评论分析或创作数据输出相关的业务实现。虽然重试函数可能作为内部支持组件被其他业务代码调用，但就该代码片段本身而言，其行为与声明用途明显不一致，因此应判定为描述与实际代码存在不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 91% confidence
- Finding
声明描述的是一个面向内容创作辅助的综合小红书数据技能，强调提供高赞笔记、热门评论、竞品风格等参考数据。实际代码却只展示了一个
post-cli，其核心功能是根据公开的小红书博主主页链接获取该主页的笔记列表/任务结果。代码中没有看到评论抓取、点赞热度筛选、爆款分析、竞品风格归纳等实现，也没有任何与“选题推荐”直接相关的逻辑。因此，实际行为比声明更窄且能力点不一致，构成描述与行为不匹配。- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "只拉这条笔记的评论做观点归纳: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "只拉这条笔记的评论做观点归纳: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "只拉这条笔记的评论做观点归纳: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "只拉这条笔记的评论做观点归纳: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "只拉这条笔记的评论做观点归纳: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "只拉这条笔记的评论做观点归纳: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The manifest description is entirely in Chinese and defines invocation/use conditions only in Chinese, which effectively constrains the skill's natural-language interface to one language. There is no indication that users may interact in other languages or that the Chinese-only scope is an intentional, justified regional limitation.
- Content