T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/request.js:79- Finding
API credential transmitted in URL query strings
- Content
View full analysis
- Remediation
View remediation
Security audit
guaikei·小红书达人评估数据
Security checks for vulnerabilities and agentic risk
Overview
This skill is a purpose-aligned Xiaohongshu public-data retrieval tool, with manageable privacy and credential-handling risks users should understand.
Install only if you are comfortable sending Xiaohongshu keywords, URLs, limits, and your GUAIKEI_API_TOKEN to Guaikei for processing. Use it only for public/authorized data, protect and rotate the token as needed, and review or delete the generated logs because they may contain comments, profile data, request details, and xsec_token-bearing links.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
src/utils/log.js:5- Finding
Complete API results are automatically persisted in plaintext
- Content
View full analysis
|]/g, "_") .replace(/\.\.+/g, "_") .replace(/^\.+|\.+$/g, ""); if (safeFilename.length > 200) { safeFilename = safeFilename.substring(0, 200); } if (safeFilename === "") { safeFilename = `log_${Date.now()}`; } const outputFilename = path.join( path.dirname(__filename), "..", "..", "logs", safeFilename, ); try { await fs.promises.mkdir(path.dirname(outputFilename), { recursive: true }); await fs.promises.writeFile(outputFilename, content); utils.printSuccess(` → 已保存到 ${outputFilename}`); } catch (error) { utils.printError(`日志写入失败: ${error.message}`); } } ``` Successful CLI operations pass the complete JSON response to this function. For example, the search CLI performs: ```js await log.taskWrite( `${startTime}_${keyword}_${type}_${sort}_${limit}_search.json`, JSON.stringify(finalOutput, null, 2), ); ``` Equivalent unconditional writes occur after successful comment, detail, and creator-post requests. ### Technical Analysis Successful results are written automatically to plaintext files under the project directory. The code does not require an explicit output option, apply field-level redaction, set a re ...[truncated 2141 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (38)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明描述的是一个面向小红书的数据采集技能，核心能力应包括访问小红书相关资源并获取结构化内容数据。但提供的代码片段只包含通用参数解析函数 parseArgs、readValueAfterFlag 和 buildHelp，没有任何网络请求、平台接口调用、数据抓取、解析小红书内容或结构化输出逻辑。因此该代码的实际行为与声明的主要用途存在明显不一致。这不是单纯的支持性实现细节，因为当前片段本身的功能完全是 CLI 工具层，而非所声明的采集能力。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
声明的核心用途是从小红书采集公开内容数据，但给出的代码片段实际只使用 fs 和 path 在本地读取 package.json 并返回 name 字段。这与声明的主要功能完全不一致。虽然这可能只是辅助代码片段，但就该片段本身而言，它展现的是本地文件访问和元数据读取能力，而不是小红书内容抓取。根据评估标准，应判定描述与实际行为不匹配。
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这篇爆款笔记的详情和互动数据: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy'"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这篇爆款笔记的详情和互动数据: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy'"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这篇爆款笔记的详情和互动数据: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy'"
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill declares access to an environment secret (
GUAIKEI_API_TOKEN) but does not define an explicit tool scope or permission boundary. That weakens least-privilege guarantees and makes it harder to audit what the skill may access at runtime, especially in agent platforms where undeclared capabilities can still be reachable through wrappers or future code changes.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill says it should be used even when the user did not explicitly ask to 'collect' or 'scrape' data, as long as the task involves obtaining Xiaohongshu content. This broad trigger increases the chance of silent third-party data transmission and unexpected scraping actions without sufficiently informed user intent, which is risky for privacy, consent, and policy compliance.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill routes user-provided Xiaohongshu links and search terms through a third-party API, but the main usage sections do not prominently warn users before collection begins. Because links may contain identifiers or tracking/query parameters and searches may reveal sensitive business intent, lack of up-front disclosure can lead to unintended data sharing with an external service.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README states that all task results are automatically saved to the
logs/directory, but it does not warn users that those results may include sensitive operational data such as searched keywords, profile or note URLs with tokens, comment content, and analysis outputs. In this skill’s context, the tool is explicitly used for scraping and evaluating third-party social media data at scale, so unattended local retention increases the risk of accidental disclosure, over-collection, or insecure sharing of scraped datasets.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The file title and all invocation guidance are written exclusively in Chinese, and the natural-language trigger examples assume Chinese user phrasing. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless the constraint is explicitly documented and justified, which is not present here.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The natural-language content in the module header, function descriptions, and error messages is exclusively in Chinese, which can constitute a language policy violation when no user opt-in or locale constraint is documented. The file does not indicate that the skill is intended only for Chinese-speaking users or a China-specific compliance context.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This file uses Chinese-only natural language in module documentation and parameter descriptions, and later emits Chinese-only error/retry messages. Under the policy rule, forcing a specific language without user opt-in or a clearly documented region-specific justification is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The thrown error and retry log strings are hardcoded in Chinese, which enforces a single language for operational output. The file does not indicate that users can choose locale or that the skill is explicitly limited to Chinese-speaking users.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The user-facing strings at L22-L25 are entirely in Chinese and there is no indication that the skill is region-specific or that users can opt into another language. This is a natural-language policy concern because the skill imposes a specific language for warnings and instructions without user choice.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Multiple error strings are presented only in Chinese, including credential and request-failure messages, with no indication that users can select another language. This imposes a specific language on users without opt-in, which matches the locale/language policy violation criteria.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 72% confidence
- Finding
The error message explicitly references the GUAIKEI_API_TOKEN environment variable, indicating this request flow depends on credentials from the environment, yet the file provides no user-facing disclosure or documentation warning about credential usage. Access to sensitive environment variables or credentials is in scope for missing-warning findings in code files.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
This code sends caller-provided params and data over HTTPS via both GET query strings and POST JSON bodies, but the file contains no confirmation prompt, logging, comment, or docstring disclosing that user or system data may be transmitted to a remote service. Because network transmission is safety-relevant for code files under this rule, the lack of any visible disclosure is a quality/safety gap.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This JavaScript file contains natural-language comments and error messages exclusively in Chinese, such as the validation messages printed to users. Under the stated policy, forcing a specific language without user opt-in or clear justification is a natural-language policy violation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This code persists the full command output, including the requested note URL and retrieved comment data, to a JSON file via log.taskWrite. While the tool prints status messages, there is no user-facing disclosure here that results will be saved to disk, which is a file-write operation with potential privacy impact.
- Content
Static analysis
Detected: suspicious.exposed_secret_literal
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- SKILL.md:16