T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/request.js:76- Finding
API Token Transmitted in URL Query Parameters
- Content
View full analysis
- Remediation
View remediation
Security audit
guaikei-xhs-look-up
Security checks for vulnerabilities and agentic risk
Overview
The skill matches its stated Xiaohongshu data-lookup purpose, but it handles credentials and saved result files in ways users should review before installing.
Install only if you are comfortable sending Xiaohongshu keywords, note/profile URLs, and your GUAIKEI API token to guaikei.com. Treat the token as sensitive, rotate it if exposed, and review or clean the local logs directory after use because fetched results are saved automatically.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
src/utils/log.js:24- Finding
Successful API Results Are Automatically Persisted Without Explicit User Consent
- Content
View full analysis
- Remediation
View remediation
` or `--save`. 2. Do not write any file when the user only requests standard output. 3. Clearly document which fields are stored, the destination directory, and the retention behavior. 4. If persistence is enabled, create files with owner-only permissions: ```js await fs.promises.writeFile(outputFilename, content, { mode: 0o600 }); ``` 5. Create the containing directory with restrictive permissions, such as mode `0700`. 6. Redact or remove API credentials and `xsec_token` query parameters before saving data when those values are not required in the output. 7. Provide a configurable retention policy and a cleanup mechanism for expired result files. 8. Avoid storing full responses by default; allow users to select only the fields needed for subsequent processing. 9. Add tests confirming that no files are created unless persistence is explicitly requested. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (53)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
从代码看，
createPostTask调用/api/xiaohongshu/post/url创建基于博主URL的已发布笔记任务，getPostTask调用/api/xiaohongshu/post/info查询该任务结果，参数也仅包含token、url、limit。因此该代码块实际覆盖的能力是“抓取某博主公开作品列表”。而声明还包含关键词搜索、笔记详情、评论获取等多个功能，但在此代码块中均未体现。虽然代码行为属于声明的一部分，没有发现登录或发布等越权行为，但就‘描述是否准确代表该代码块实际做什么’而言，声明明显比实际代码宽泛，存在实质性描述—行为不一致。- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
代码行为与声明存在范围不一致。当前代码只围绕关键词搜索：调用 /api/xiaohongshu/note-search/keyword 创建搜索任务，调用 /api/xiaohongshu/note-search/info 获取搜索结果，并为笔记和用户拼接URL。这与声明中的“按关键词搜索小红书笔记”部分一致，也未发现登录或内容发布等越权能力。但声明还包含笔记详情、评论数据、博主作品列表等能力，而这些在该代码片段中没有体现。按给定标准，若代码主能力与声明相比存在实质性不同或范围不符，应判为不匹配。这里更准确地说是声明覆盖范围明显大于该代码实际实现范围，因此应标记为 mismatch。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
代码片段仅实现了通用的命令行参数解析器（parseArgs/readValueAfterFlag/buildHelp），用于处理 flags、位置参数、默认值、重复参数检查、必填校验和帮助信息输出。它没有体现任何与小红书相关的搜索、笔记详情抓取、评论获取、博主作品抓取、结构化数据返回等核心能力。虽然这类工具代码可能作为整体技能的辅助模块存在，但就该代码片段本身而言，其实际行为与声明的主要用途明显不一致，因此应判定为描述与行为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
声明描述的是面向小红书内容检索/抓取的数据获取能力，而实际代码片段并未体现任何搜索、抓取、笔记详情、评论获取或博主作品列表采集逻辑。相反，它执行的是本地日志文件写入这一完全不同的功能。虽然日志记录可能是辅助实现细节，但就该代码片段本身而言，其行为与声明的核心能力没有直接对应关系，并且涉及未声明的本地文件系统写入能力。因此应判定为描述与代码行为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description presents a skill for structured Xiaohongshu content retrieval and analytics support. However, the supplied code chunk does not implement any network access, search, scraping, note retrieval, comment retrieval, or creator works listing. It merely reads a local package.json from disk and returns the package name. This is a materially different primary purpose and accesses a different resource class (local filesystem metadata rather than Xiaohongshu content), so the description does not accurately represent this code chunk.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "只拉这条笔记的评论数据做观点归纳: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "只拉这条笔记的评论数据做观点归纳: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "只拉这条笔记的评论数据做观点归纳: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "只拉这条笔记的评论数据做观点归纳: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "只拉这条笔记的评论数据做观点归纳: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 83% confidence
- Finding
The skill declares access to a sensitive environment variable (
GUAIKEI_API_TOKEN) but does not define an explicit tool/permission scope such aspermissionsorallowed-tools. In an agent setting, missing scope boundaries can lead to broader-than-necessary execution privileges and make it harder to enforce least privilege or review what the skill is allowed to access.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The manifest description is written as an unconditional Chinese-language invocation/behavior description, and the file consistently presents the skill as operating only in Chinese without any user opt-in or alternative locale. Under the policy, forcing a specific language or locale without user choice is a natural-language policy violation unless clearly justified as region-specific.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README states that all task results are automatically saved to the
logs/directory, but it does not clearly warn users that scraped note details, comments, keywords, profile URLs, or other potentially sensitive business data will be persisted locally. In a data-collection skill, silent persistence increases the risk of unintended retention, disclosure, or later exfiltration of collected data, especially on shared machines or when logs are backed up or committed inadvertently.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
Manifest 描述将技能范围限定为按关键词搜索笔记、查看笔记详情与评论、单独获取评论数据、以及抓取博主公开作品列表，并强调返回结构化数据用于分析，不涉及更深层处理。更新日志在 L42 明确写到“新增小红书笔记详情与评论情绪分析功能”，这表明文档声明过一项比当前技能描述更宽的分析能力，存在技能宣称范围与实际/历史行为范围不一致的迹象。
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The skill documentation is entirely written in Chinese and the natural-language trigger examples are all Chinese, with no indication that users may interact in other languages or choose a preferred locale. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is explicitly documented and justified.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This code sends an API token and note URL to a remote endpoint via postJson, which is a network operation involving potentially sensitive user/system data. While the JSDoc describes parameters, it does not warn users that their token and target URL will be transmitted, and there is no confirmation prompt or user-facing disclosure in this file.
- Content
Static analysis
Detected: suspicious.exposed_secret_literal
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- SKILL.md:16