T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/request.js:76- Finding
API Credential Exposed in URL Query Strings
- Content
View full analysis
- Remediation
View remediation
Security audit
guaikei-xhs-insight-extractor
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent Xiaohongshu public-data tool, but it needs review because it exposes credentials in request URLs and automatically saves token-bearing links and retrieved data locally.
Review before installing. Use a limited/rotatable Guaikei token, avoid running in shared terminals or CI logs, do not paste token-bearing Xiaohongshu URLs into public places, and clean or protect the generated logs/ directory after use. Rotate the API token if it has been printed or logged.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
src/xiaohongshu/comment-cli.js:137- Finding
Automatic Persistence of Token-Bearing URLs and Retrieved Social Data
- Content
View full analysis
|]/g, "_") .replace(/\.\.+/g, "_") .replace(/^\.+|\.+$/g, ""); if (safeFilename.length > 200) { safeFilename = safeFilename.substring(0, 200); } if (safeFilename === "") { safeFilename = `log_${Date.now()}`; } const outputFilename = path.join( path.dirname(__filename), "..", "..", "logs", safeFilename, ); try { await fs.promises.mkdir(path.dirname(outputFilename), { recursive: true }); await fs.promises.writeFile(outputFilename, content); utils.printSuccess(` → 已保存到 ${outputFilename}`); } catch (error) { utils.printError(`日志写入失败: ${error.message} ...[truncated 2140 chars]- Remediation
View remediation
` or `--save`. 2. Redact sensitive query parameters before output or storage, including `xsec_token`, `token`, and future authentication parameters: ```js const parsed = new URL(url); for (const key of ["xsec_token", "token"]) { if (parsed.searchParams.has(key)) { parsed.searchParams.set(key, "[REDACTED]"); } } ``` 3. Store only the minimum fields required by the user rather than the complete API response. 4. When persistence is explicitly requested, create files with restrictive permissions: ```js await fs.promises.writeFile(outputFilename, content, { mode: 0o600 }); ``` 5. Create the output directory with restrictive permissions where supported and reject symbolic-link destinations if an attacker can influence the workspace. 6. Document the output location, contents, permissions, and retention behavior. 7. Provide a retention limit or cleanup command, and avoid including generated logs in version control, backups, and CI artifacts unless explicitly intended. 8. Consider encryption at rest when saved results contain data subject to organizational privacy or compliance controls. ]]>
T09 · Insecure Skill Coding Practices
Note
- Location
SKILL.md:242- Finding
Troubleshooting Documentation Encourages Printing the Complete API Token
- Content
View full analysis
`GUAIKEI_API_TOKEN` 未配置或无效。确认：①环境变量已注入当前进程（`echo $GUAIKEI_API_TOKEN`）；②token 为 32 位十六进制，无多余空格/换行；③去 guaikei.com 重新开通。 ``` ```markdown **Q7. 命令一启动就退出、没输出数据？** > 多半是 `GUAIKEI_API_TOKEN` 未通过校验。运行前先 `echo $GUAIKEI_API_TOKEN` 确认变量已注入。 ``` ### Technical Analysis The troubleshooting instructions recommend `echo $GUAIKEI_API_TOKEN`, which prints the complete API credential to standard output. Although this command does not normally add the expanded value to shell history, the output remains visible in terminal scrollback and may be captured by screen recordings, shared terminals, CI logs, remote-session logging, support transcripts, or AI-agent execution records. Secret-diagnostic procedures should verify presence or format without disclosing the full value. ### Attack Path 1. Authentication fails or the CLI exits during token validation. 2. The user follows the documented troubleshooting command. 3. The terminal prints the complete API token. 4. A person viewing the terminal, a screen-sharing participant, or a system collecting command output records the credential. 5. The observer reuses the token against the third-party API. ### Impact Assessment A disclosed credential may allow unauthorized API calls within the token's assigned privileges and quota. Potential effects include quota consumption, billing impact, access to credential-scoped API functionality, and denial of service through quota exhaustion. Exploitation requires visibility into the user's terminal output or captured logs and does not directly grant local system privileges. ]]>- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (72)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
A tool described as topic/keyword search also performs creator-page collection based on profile URLs, which is a separate monitoring capability. In context, this increases risk of unintentional surveillance-style use or broader-than-expected collection of a creator's published content.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
A tool described as topic/keyword search also performs creator-page collection based on profile URLs, which is a separate monitoring capability. In context, this increases risk of unintentional surveillance-style use or broader-than-expected collection of a creator's published content.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
A tool described as topic/keyword search also performs creator-page collection based on profile URLs, which is a separate monitoring capability. In context, this increases risk of unintentional surveillance-style use or broader-than-expected collection of a creator's published content.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
A tool described as topic/keyword search also performs creator-page collection based on profile URLs, which is a separate monitoring capability. In context, this increases risk of unintentional surveillance-style use or broader-than-expected collection of a creator's published content.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
A tool described as topic/keyword search also performs creator-page collection based on profile URLs, which is a separate monitoring capability. In context, this increases risk of unintentional surveillance-style use or broader-than-expected collection of a creator's published content.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
A tool described as topic/keyword search also performs creator-page collection based on profile URLs, which is a separate monitoring capability. In context, this increases risk of unintentional surveillance-style use or broader-than-expected collection of a creator's published content.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
A tool described as topic/keyword search also performs creator-page collection based on profile URLs, which is a separate monitoring capability. In context, this increases risk of unintentional surveillance-style use or broader-than-expected collection of a creator's published content.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
A tool described as topic/keyword search also performs creator-page collection based on profile URLs, which is a separate monitoring capability. In context, this increases risk of unintentional surveillance-style use or broader-than-expected collection of a creator's published content.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
A tool described as topic/keyword search also performs creator-page collection based on profile URLs, which is a separate monitoring capability. In context, this increases risk of unintentional surveillance-style use or broader-than-expected collection of a creator's published content.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "只拉这条笔记的评论做观点归纳: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "只拉这条笔记的评论做观点归纳: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "只拉这条笔记的评论做观点归纳: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "只拉这条笔记的评论做观点归纳: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "只拉这条笔记的评论做观点归纳: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"