T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/request.js:76- Finding
API Credential Transmitted in URL Query Strings
- Content
View full analysis
- Remediation
View remediation
Security audit
guaikei-xhs-hot-notes
Security checks for vulnerabilities and agentic risk
Overview
The skill does what it claims, but it sends an API credential in URL query strings and automatically saves full collected results to plaintext log files, which users should review before installing.
Install only if you are comfortable sending Xiaohongshu keywords, URLs, and your GUAIKEI_API_TOKEN to guaikei.com. Treat generated logs as sensitive: they may contain research topics, collected comments/profile data, and xsec_token URLs. Prefer using this in a private workspace, rotate the API token if exposed, and delete or protect logs after use.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/log.js:27- Finding
Full API Results Persisted in Plaintext Files with Default Permissions
- Content
View full analysis
- Remediation
View remediation
` or `--save-results`. 2. Do not automatically retain complete API responses by default. 3. When writing files on Unix-like systems, explicitly restrict permissions: ```javascript await fs.promises.mkdir(path.dirname(outputFilename), { recursive: true, mode: 0o700, }); await fs.promises.writeFile(outputFilename, content, { mode: 0o600, flag: "wx", }); ``` 4. Redact sensitive query parameters before logging or persistence, including `xsec_token`, `token`, cookies, and future authorization fields. 5. Store only the minimum data necessary for the user's requested output. 6. Add a configurable retention policy and delete expired result files automatically. 7. Add `logs/` to `.gitignore` and exclude it from CI artifacts, container images, backups, and diagnostic bundles unless explicitly required. 8. Clearly disclose the storage location, retained fields, file permissions, and deletion procedure in `SKILL.md`, not only in the general README. 9. For environments requiring durable retention, support encrypted output and require the user to provide or select the encryption key. 10. Add tests verifying that persisted output does not contain API credentials or sensitive URL query parameters. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (47)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "只拉这条笔记的评论数据做观点归纳: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "只拉这条笔记的评论数据做观点归纳: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "只拉这条笔记的评论数据做观点归纳: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "只拉这条笔记的评论数据做观点归纳: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "只拉这条笔记的评论数据做观点归纳: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The manifest description is entirely written as a prescriptive Chinese invocation/usage description and does not indicate that users may interact in other languages or choose a locale. Under the policy, locale or language constraints should either be optional for the user or clearly justified as region-specific; that justification is not stated here.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill instructs the agent to retrieve Xiaohongshu data via a third-party API service, but the warning about data external transmission appears only later in the document rather than prominently near activation and execution steps. Users may provide URLs, keywords, and potentially sensitive research targets without realizing that this information is sent to guaikei.com, creating privacy, confidentiality, and compliance risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This markdown file applies to SQP-2, and it documents operations that retrieve public content, comments, and account activity data from Xiaohongshu. While it explains inputs and usage, it does not warn users about privacy considerations, platform terms, or the sensitivity of analyzing third-party comment/account data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The function sends a token and note URL to a remote API via postJson, which is a privacy-relevant network operation. Although the docstring describes parameters, it does not warn users that their token and URL will be transmitted to an external service.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
This code performs a network request containing the API token and note URL, which may expose user or system data to an external service. The existing comments describe function inputs and errors but do not provide a safety or privacy warning about the transmission.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This code sends a sensitive credential (
token) in HTTP requests when creating a search task. Although the JSDoc names the parameter as an API token, there is no user-facing warning, confirmation, or explicit disclosure in this file that the skill will transmit credentials to a remote service.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This function transmits the user's search keyword together with the API token to a remote endpoint via
getJson. The file lacks a visible user-facing warning or disclosure that user-provided query data and credentials are being sent externally.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The user-facing strings are entirely in Chinese and present no option for another language or locale. For a general utility module, this is a natural-language policy concern because it imposes a specific language on users without opt-in or a documented region-specific justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Multiple error messages in this file are hard-coded in Chinese, including operational guidance and failure messages. Because the file does not offer localization, user choice, or a documented region-specific justification, this appears to enforce a specific language on all users.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The
postJsonandgetJsonhelpers build and send network requests, including query parameters and request bodies, toconstants.BASE_URL. In this file there is no confirmation prompt, user-facing log/print, or explanatory comment/docstring disclosing that user or system data may be transmitted over the network.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This code uses Chinese-only comments and user-visible error messages throughout, such as the validation errors printed to users. The file provides no option to select another language and no documented justification that the skill is intended only for a Chinese-language or region-specific context, which conflicts with the language/locale policy for natural-language content.
- Content
Static analysis
Detected: suspicious.exposed_secret_literal
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- SKILL.md:16