T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/request.js:78- Finding
Reusable API token transmitted in URL query strings
- Content
View full analysis
- Remediation
View remediation
Security audit
guaikei·小红书营销数据
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a coherent Xiaohongshu public-data retrieval tool, but it handles credentials and retained results in ways users should review before installing.
Install only if you are comfortable sending Xiaohongshu research inputs and your Guaikei API token to the Guaikei service. Treat the token as sensitive, monitor or rotate it if used, and review or delete the local logs/ directory because saved outputs may reveal research targets and token-bearing Xiaohongshu URLs.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
src/xiaohongshu/detail-cli.js:143- Finding
Collected results and token-bearing Xiaohongshu URLs are automatically stored in plaintext
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (59)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
声明的核心能力是围绕“博主主页链接”抓取账号公开作品列表，并结合详情与评论做账号级竞品分析；而这段代码的行为明显更窄，只支持基于单个笔记URL创建详情/评论抓取任务并查询结果。虽然‘笔记详情与评论’属于声明中提到的组成部分，但缺失了关键的‘博主作品列表’抓取与账号级分析入口，因此与声明的主要用途不一致。代码也没有显示访问私密数据或登录态数据，所以不匹配点主要在功能范围和主用途缩水，而不是越权。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
声明的核心能力是针对指定小红书博主主页做公开内容采集与竞品分析支撑，包括作品列表、详情和评论的还原与分析。实际代码仅包含两个搜索接口：创建关键词搜索任务与获取关键词搜索结果，并对结果补充笔记/用户主页URL。这与“博主主页内容抓取”是不同入口和不同主目标。代码也没有出现评论、详情、时间节奏分析、互动表现分析等实现。因此该代码块与声明用途存在实质性不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明描述的是一个面向小红书竞品分析的数据抓取与内容分析技能，核心能力应包括访问小红书公开页面/接口、提取博主作品与评论数据，并据此进行分析。而提供的代码片段只是独立的通用 CLI 参数解析模块，处理命令行输入、参数校验和帮助文案生成。它既没有访问小红书，也没有抓取、解析、分析任何内容数据。虽然这类参数解析可能是更大工具的辅助组件，但就当前代码片段本身而言，其行为与声明的主要用途明显不一致，因此应判定为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
声明描述的是一个面向小红书公开数据抓取与内容分析的技能，但实际代码片段只处理访问令牌的有效性校验，并在无效时提示联系微信获取私有 TOKEN。该代码没有体现任何与小红书页面访问、作品列表抓取、笔记详情获取、评论读取或内容分析有关的行为。虽然 token 管理可能是某些技能的辅助实现细节，但这里代码所展示的实际功能与声明的核心用途完全不一致，且暴露出一个未在描述中提及的私有 API 令牌依赖，因此应判定为描述与行为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
声明描述的是一个面向小红书公开内容抓取与分析的技能，而代码片段实际只实现了本地日志文件写入功能，没有体现任何小红书页面访问、作品列表抓取、笔记详情获取、评论抓取或竞品分析逻辑。虽然日志记录可能是辅助实现细节，但当前提供的代码片段本身的行为与声明的核心用途明显不一致；其实际访问的资源是本地文件系统，而声明未体现这一能力。因此应判定为描述与代码行为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared purpose is a Xiaohongshu public-account scraping and analysis skill. The actual code chunk is a simple utility that reads package.json from the local filesystem and returns the package name. This is materially unrelated to the declared primary purpose and uses a different resource (local files rather than public Xiaohongshu data). While this may be a helper file within a larger project, based on the supplied code chunk alone it does not implement or support the described scraping/analysis behavior in any evident way, so this should be flagged as a mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
该代码片段的功能非常有限且明确：验证关键词是否为空、长度是否合法、是否包含特殊字符或 http 链接，清洗关键词字符，并规范化搜索参数。声明描述的是一个面向小红书博主竞品分析的数据抓取与分析技能，其核心行为应包括访问博主主页、获取公开作品列表、抓取笔记详情和评论、并进行分析。当前代码既没有展示任何网络请求、页面解析、博主链接处理，也没有任何分析逻辑，因此其实际行为与声明的主要用途存在明显不匹配。这不是单纯的底层支持细节，因为片段所反映的能力中心是“关键词搜索输入校验”，而不是“博主内容抓取分析”。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
声明描述的是一个账号级别的小红书竞品/博主分析能力，核心在于抓取“博主公开作品列表”，再结合多篇笔记详情与评论进行整体分析。实际代码却是 detail-cli，只接受“单个笔记链接”作为输入，验证其是否为笔记 URL，然后获取这一篇笔记的详情和评论，输出结果并记录日志。代码中没有任何博主主页解析、作品列表枚举、跨多篇笔记聚合、节奏/风格/互动表现分析逻辑。因此其主要目的明显比声明更窄且不同，属于描述与行为不符。与此同时，代码访问的仍是公开笔记数据，没有看到登录态或私密数据访问，这部分与声明不冲突。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 89% confidence
- Finding
声明描述的是一个较完整的竞品分析型技能：不仅抓取公开作品列表，还要配合笔记详情与评论来还原发文节奏、内容风格和互动表现。而提供的代码片段只是一个 post CLI：输入博主主页 URL 和 limit，调用 createPostTask/getPostTask 获取“主页笔记任务”结果，并输出 JSON。它没有显示评论抓取、详情抓取或任何分析逻辑。虽然这些能力可能存在于未展示的其他模块中，但就此代码片段可见行为而言，其主要功能更接近“获取博主主页笔记列表”。因此，代码行为明显窄于声明目的，构成描述与实际行为不完全一致。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
声明描述的是一个面向“博主账号/主页”的竞品分析技能，核心能力应包括：抓取指定博主的公开作品列表，并结合笔记详情与评论还原其内容与互动表现。而代码实际只实现了通用关键词搜索流程：接收 keyword/type/sort/time/limit 参数，验证和清洗关键词，调用 search.createSearchTask 与 search.getSearchTask 获取搜索结果，然后将结果输出并记录日志。代码中没有出现博主主页链接解析、博主作品列表抓取、笔记详情抓取、评论抓取或任何分析逻辑。因此其主要用途与声明存在实质性偏差，应判定为不匹配。
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | 看某篇笔记的详情+评论 | `src/xiaohongshu/detail-cli.js` | 笔记 URL | `explore/` 或短链 |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | 看某篇笔记的详情+评论 | `src/xiaohongshu/detail-cli.js` | 笔记 URL | `explore/` 或短链 |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | 看某篇笔记的详情+评论 | `src/xiaohongshu/detail-cli.js` | 笔记 URL | `explore/` 或短链 |
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 82% confidence
- Finding
The skill declares use of an environment secret (
GUAIKEI_API_TOKEN) but does not declare a restrictive tool scope such aspermissionsorallowed-tools. That omission weakens least-privilege controls and makes it harder to bound how secrets and command execution may be used if the skill or downstream scripts are changed or abused.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill states that every execution result is automatically archived to a local
logs/directory, but it does not present a clear upfront warning, consent model, retention period, or sanitization policy. Because results may include user-supplied links, keywords, fetched content, and metadata, this creates an avoidable data retention and privacy exposure on the host system.- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill derives log filenames from user-provided keywords or links and persists execution results automatically, creating a natural-language data retention path for potentially sensitive or identifying inputs. Even if inputs are intended to be public Xiaohongshu URLs, stored filenames and result bodies can reveal user interests, targets of monitoring, campaign plans, and other business-sensitive context.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The README advertises substantially broader collection and analysis capabilities than the skill metadata, including keyword search, trend monitoring, KOL screening, and comment analysis. This scope mismatch can mislead operators and downstream agents into invoking functionality outside the declared purpose, weakening trust boundaries and increasing the chance of unauthorized data collection or policy violations.
- Content