T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/request.js:76- Finding
API Credential Exposed in URL Query Strings
- Content
View full analysis
- Remediation
View remediation
Security audit
guaikei·小红书看详情找洞察
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly does what it claims, but it handles tokens and saved results in ways users should review before installing.
Install only if you are comfortable sending Xiaohongshu keywords and URLs to Guaikei's API and with results being saved locally under logs/. Avoid private or sensitive links, treat any xsec_token-bearing URLs as sensitive, clean up generated log files, and consider rotating GUAIKEI_API_TOKEN if it has already been used with this implementation.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
src/xiaohongshu/detail-cli.js:137- Finding
Sensitive URLs and Retrieved Data Automatically Persisted in Plaintext
- Content
View full analysis
|]/g, "_") .replace(/\.\.+/g, "_") .replace(/^\.+|\.+$/g, ""); if (safeFilename.length > 200) { safeFilename = safeFilename.substring(0, 200); } if (safeFilename === "") { safeFilename = `log_${Date.now()}`; } const outputFilename = path.join( path.dirname(__filename), "..", "..", "logs", safeFilename, ); try { await fs.promises.mkdir(path.dirname(outputFilename), { recursive: true }); ...[truncated 3340 chars]- Remediation
View remediation
` or `--save`. 2. Before printing or storing a URL, parse it with the standard `URL` class and redact sensitive parameters such as `xsec_token`, `token`, `access_token`, and `auth`. 3. Store only the minimum fields required by the user instead of automatically retaining complete API responses. 4. Create log directories and result files with restrictive permissions: ```js await fs.promises.mkdir(directory, { recursive: true, mode: 0o700, }); await fs.promises.writeFile(outputFilename, content, { encoding: "utf8", mode: 0o600, flag: "wx", }); ``` 5. Warn users before persisting results that may contain user-linked or tokenized data. 6. Add configurable retention and secure cleanup behavior. 7. Exclude `logs/` from version control, package publication, build artifacts, and automatic workspace synchronization where possible. 8. For environments requiring persistent results, support encryption at rest or require a caller-selected protected output location. 9. Add automated tests confirming that serialized output never contains known sensitive query-parameter values. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (69)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
声明描述的是一个通用的小红书链接解析与路由技能，会根据链接类型分发到详情、评论、主页作品列表或短链解析等不同处理路径。但提供的代码仅涉及评论模块，只对笔记链接发起评论任务和查询评论结果，没有看到任何链接类型识别、主页处理、短链展开、详情获取或触发条件判断逻辑。因此该代码片段的实际行为与声明的主要用途不一致。虽然“笔记链接走评论”是声明中的一部分，但当前代码只覆盖其中一个子能力，无法支持整个已声明技能的核心描述。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
声明描述的是一个根据不同小红书链接类型进行自动分流的综合技能，但提供的代码仅包含 detail.js，功能集中在“笔记详情和评论”任务的创建与结果获取。它调用 /api/xiaohongshu/detail/url 与 /api/xiaohongshu/detail/info，参数也是 url 与 limit，明显针对笔记详情/评论场景。虽然返回结果中会拼接笔记链接和用户主页链接，但这只是结果整理，不等于支持主页作品列表抓取或短链目标解析。因此，代码实际行为只覆盖声明中的一部分，缺少声明中的核心路由与其他链接类型处理能力，构成描述与行为不一致。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The declared description presents a general-purpose Xiaohongshu link router that distinguishes explore/, user/profile/, and xhslink URLs and dispatches to different behaviors. The supplied code chunk is much narrower: it interacts with /api/xiaohongshu/post/url and /api/xiaohongshu/post/info to create and query a task for a blogger/profile URL and return published notes. That aligns only with the subset about profile pages leading to a works list. There is no evidence here of note-detail retrieval, comment retrieval, short-link parsing/resolution, or any routing logic based on URL type. Therefore the description overstates the implemented behavior for this code chunk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明的核心功能是“按小红书链接类型自动路由并解析链接对应内容”，重点在处理用户提供的链接（笔记链接、博主主页、短链）。但实际代码并不接收或解析链接，也没有识别 explore/、user/profile/ 或 xhslink 的逻辑。相反，它以 keyword、type、sort、time、limit 为输入，调用 /api/xiaohongshu/note-search/keyword 和 /api/xiaohongshu/note-search/info 两个搜索接口来创建和获取关键词搜索结果。这属于与声明明显不同的主要用途，因此应判定为描述与行为不一致。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The description presents a Xiaohongshu link analysis/router skill, but the supplied code chunk is merely a constants file. It exposes infrastructure settings and references an unrelated base URL, with no evidence of handling explore/, user/profile/, or xhslink URLs. Because the actual code shown does not match the declared primary purpose and points to an inconsistent resource, this should be flagged as a mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明描述的是一个面向小红书链接的业务技能，核心能力应包括识别 explore/user/profile/xhslink 等链接类型并按类型路由到详情、评论、作品列表或短链解析。实际代码只是 src/utils/args.js 中的通用参数解析与帮助文本生成模块，属于底层 CLI 支撑工具。它既不处理 URL，也不访问小红书资源，不包含任何与链接类型判断、内容获取、短链展开、评论/作品列表相关的实现。因此代码实际行为与声明用途存在明显且实质性的不一致。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
声明描述的核心能力是“小红书链接解析与路由”，而该代码片段的核心行为是“API TOKEN 校验与提示”。两者主功能明显不一致。该代码没有处理任何链接类型、页面内容、评论、主页作品或短链解析，也没有体现与小红书相关的资源访问。虽然 TOKEN 管理可能是某个更大技能的配套实现，但就提供的代码片段而言，其实际行为与声明用途不匹配，且包含未在描述中体现的私有 TOKEN 获取提示和联系方式输出。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明描述的是一个面向小红书链接识别与路由解析的技能，核心行为应当涉及链接类型判断、短链解析、详情/评论/作品列表路由等。而代码片段实际只是一个日志工具模块，负责将提供的内容写入本地 logs 目录中的文件，并未体现任何与小红书链接处理、页面解析或路由相关的逻辑。虽然日志记录可能是辅助实现细节，但当前提供的代码片段本身的直接功能与声明用途明显不一致，且涉及未声明的本地文件写入能力。因此应判定为描述与行为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description is about automatically recognizing and routing Xiaohongshu URLs to different analysis paths. The provided code does none of that: it only reads package.json from disk and returns the package name. This is a materially different purpose and uses a different resource (local filesystem metadata) than the declared skill behavior. While this may be a helper utility within a larger project, this specific code chunk does not match the declared functionality.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
声明描述的是一个面向小红书链接的业务路由技能，而提供的代码片段只是底层通用重试辅助函数。重试逻辑可能作为此类技能的支持性实现存在，但当前片段本身并不能体现声明中的核心能力，也没有处理链接、页面类型、内容抓取或解析。因此该代码片段与声明用途存在明显不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description describes a Xiaohongshu link-routing skill with behavior based on URL patterns and content analysis entry points. However, the supplied code chunk contains only generic utility functions for printing a banner and formatted log messages to stderr. This is not merely a supporting implementation detail if assessed in isolation: the chunk itself does not implement any of the declared core behavior, and its actual purpose is unrelated utility logging. Therefore the description does not accurately represent what this supplied code chunk actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
声明描述的核心能力是“基于小红书链接进行自动路由和内容解析”。但提供的代码片段只是在做输入验证：检查关键词是否为空、长度范围、是否含特殊字符、是否包含 http 链接；并提供关键词清洗和搜索参数默认化/校验功能。这与链接解析或路由无直接关系，甚至代码会将包含 http 的内容判定为无效，与‘用户粘贴小红书链接即可适用’的声明相矛盾。因此这是明显的描述与实际行为不符。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
声明描述的是一个通用的小红书链接路由技能，核心能力应是识别不同类型链接并分派到详情、评论或主页作品列表等功能。实际代码却是一个专用的 comment-cli，只接受笔记链接，验证 note URL 后调用评论任务接口拉取评论结果。它没有检测多种链接类型并分支处理的逻辑，也没有主页作品列表或详情抓取能力。因此其主要用途明显比声明狭窄，且与声明的核心行为不一致，属于实质性描述-行为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
声明描述的是一个通用的小红书链接路由技能，会根据 explore、user/profile、xhslink 等不同链接类型选择不同处理路径。但实际代码仅是 detail-cli.js，核心行为是校验并处理笔记链接，调用 detail 接口获取详情和评论，且帮助信息与错误信息都表明其输入应为公开可访问的笔记链接。虽然 validator.isNoteUrl 允许的格式提示里包含 xhslink 短链，但这更像是支持可归一化到笔记的短链输入，并不等于实现了声明中的完整“按目标解析并路由”能力。代码中也没有博主主页作品列表处理逻辑。因此，代码行为比声明显著更窄，属于描述与实际行为不一致。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
声明描述的是一个通用的小红书链接路由技能，可根据链接类型在‘笔记详情/评论/博主作品列表’之间切换。实际代码文件 post-cli.js 的功能明显更窄：帮助文本、参数说明、校验逻辑、错误提示、输出 message 均围绕‘小红书博主链接’和‘主页笔记数量’展开；validator.isProfileUrl(url) 也表明它要求的是主页链接，而不是任意小红书链接。随后调用的 API 是 createPostTask/getPostTask，语义上也是获取博主作品列表。虽然错误提示中提到 xhslink 短链，说明可能支持将短链归一化，但这里依然服务于主页抓取场景，不等于实现了声明中的全量自动路由能力。因此代码实际行为与声明的主要用途存在实质不一致。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明的核心功能是“根据小红书链接类型自动路由并解析内容”，重点在链接识别与分流（explore、user/profile、xhslink）。但代码完全没有做 URL 识别、链接路由、详情页/评论页抓取、主页作品列表解析或短链解析。相反，它是一个基于关键词的搜索 CLI，要求提供 --keyword，并通过搜索 API 获取搜索结果，还支持排序、时间、类型、数量等搜索参数。因此其主要目的与声明显著不符，属于明显的描述-行为不匹配。
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这篇爆款笔记的详情和互动数据: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy'"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这篇爆款笔记的详情和互动数据: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy'"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这篇爆款笔记的详情和互动数据: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy'"