T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/request.js:76- Finding
API Credential Exposed in URL Query Strings
- Content
View full analysis
- Remediation
View remediation
Security audit
guaikei-xhs-note-and-comment
Security checks for vulnerabilities and agentic risk
Overview
The skill appears to do what it claims, but it handles API tokens and collected data in ways users should review before installing.
Install only if you are comfortable sending Xiaohongshu queries and URLs to Guaikei using a GUAIKEI_API_TOKEN. Treat generated logs as sensitive: they may contain xsec_token URLs and collected data, so avoid committing or sharing the logs directory and rotate the API token if you suspect request URLs have been logged or exposed.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
src/utils/log.js:5- Finding
Automatic Plaintext Persistence of Token-Bearing URLs and Collected Data
- Content
View full analysis
|]/g, "_") .replace(/\.\.+/g, "_") .replace(/^\.+|\.+$/g, ""); if (safeFilename.length > 200) { safeFilename = safeFilename.substring(0, 200); } if (safeFilename === "") { safeFilename = `log_${Date.now()}`; } const outputFilename = path.join( path.dirname(__filename), "..", "..", "logs", safeFilename, ); try { await fs.promises.mkdir(path.dirname(outputFilename), { recursive: true }); await fs.promises.writeFile(outputFilename, content); utils.printSuccess(` → 已保存到 ${outputFilename}`); } catch (error) { utils.printError(`日志写入失败: ${error.message}`); } } ``` A representative CLI serializes the complete request URL and result before storing it: ```js const finalOutput = { status: "success", error_code: "OK", message: "详情任务完成", timestamp: new Date().toLocaleString(), request: { command: "detail", url: url, limit: limit, }, skill_metadata: { skill_version: constants.VERSION, runtime_version: process.versions.node, execution_time: Date.now() - startTime, }, results: detailTask, }; console.log(JSON.stringify(finalOutput, null, 2)); utils.printSuccess(`详情任务完成, 已返回结果`); await log.taskWrite( `${startTime}_${validator.url2Name(url)}_detail.json`, JSON.stringif ...[truncated 1974 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (54)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The description claims the skill is specifically for public Xiaohongshu data and not for other platforms. However, the code shown is a constants file whose only external resource indicator is BASE_URL set to www.guaikei.com, which is not a Xiaohongshu domain. While this snippet alone does not reveal full runtime behavior, the visible configuration is inconsistent with a Xiaohongshu-only skill. Because the actual code references a different base resource and contains no Xiaohongshu-specific logic or endpoints, the declared description does not accurately match the supplied code chunk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
代码内容仅是通用参数解析与帮助文本生成工具（args.js），属于底层辅助组件。它不访问小红书，也不处理任何平台数据，更没有实现声明中所述的小红书公开数据查询能力。由于评估对象的声明强调该技能的核心用途是面向小红书公开内容的功能，而实际代码片段的主行为与此无关，因此存在明显的描述与行为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
声明描述的是一个面向小红书公开内容抓取/查询的技能，而实际代码片段并未体现任何小红书平台相关的数据搜索、详情获取、评论获取或博主作品处理逻辑。相反，它提供了对本地文件系统的写入能力，将任意字符串保存到 logs 目录下。这属于未在声明中体现的能力和资源访问（本地文件系统）。虽然日志功能可能是配套实现，但就该代码片段本身而言，其行为与声明的核心用途明显不一致，因此应判定为描述与行为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared purpose describes a platform-specific data access skill for public Xiaohongshu content. The actual code chunk does not implement any Xiaohongshu-related functionality such as searching notes, fetching details, comments, or creator content. Instead, it performs a local utility action: accessing the filesystem, reading package.json, and returning the package name. This is materially different from the declared primary purpose. While it may be a supporting utility within a larger skill, based on this chunk alone the behavior is unrelated to the declared Xiaohongshu data-processing purpose and uses undeclared local file access.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "只拉这条笔记的评论数据做观点归纳: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "只拉这条笔记的评论数据做观点归纳: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "只拉这条笔记的评论数据做观点归纳: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "只拉这条笔记的评论数据做观点归纳: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "只拉这条笔记的评论数据做观点归纳: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The manifest and README content are written entirely in Chinese and the examples, prompts, and operating guidance assume Chinese interaction, with no indication that other languages are supported or that the user can choose a preferred language. This creates a language/locale constraint that is not explicitly offered as an opt-in or justified as a region-specific requirement.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The manifest describes a skill limited to handling public Xiaohongshu data for note search, details, comments, and creator posts when the user’s task explicitly involves Xiaohongshu content. In contrast, the README positions it as a broader 'data mining' and growth/marketing tool with '趋势预测', '竞品监控', and 'KOL 筛选' as core services, which are analytical/business capabilities not reflected in the manifest’s narrower operational scope.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The documentation is entirely in Chinese while the skill metadata does not clearly declare a Chinese-only locale restriction or provide an alternate language option. In mixed-language agent environments, this can cause the orchestrator or user to misunderstand inputs, misuse the wrong script, or miss safety-relevant operational constraints such as required token configuration and platform limits.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This JavaScript file contains natural-language comments and user-visible error/help text entirely in Chinese, such as the module description, thrown error messages, and generated help output. Under the policy, forcing a specific language without user opt-in or documented justification is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This JavaScript file contains user-facing status and warning strings only in Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is documented and justified, which is not evident here.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Multiple error messages are hard-coded in Chinese, including credential and request failure messages, with no indication that the skill is China-specific or that users can choose another language. This creates a locale/language policy concern because the file enforces a single language without opt-in.
- Content
Static analysis
Detected: suspicious.exposed_secret_literal
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- SKILL.md:16