T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/request.js:72- Finding
API Token Exposed in URL Query Strings
- Content
View full analysis
- Remediation
View remediation
Security audit
guaikei-xhs-note-search
Security checks for vulnerabilities and agentic risk
Overview
The skill matches its stated Xiaohongshu public-data purpose, but it handles API credentials and saved results in ways users should review before installing.
Install only if you are comfortable sending your GUAIKEI_API_TOKEN, search terms, and Xiaohongshu URLs to the Guaikei service. Use a limited/rotatable token, protect or delete generated logs, and avoid submitting links or queries that would reveal sensitive business research unless local plaintext archival is acceptable.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
src/utils/log.js:27- Finding
Automatic Plaintext Persistence of Collected Data and URL Tokens
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (40)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
The code chunk is narrowly focused on one feature: submitting and querying a task to obtain a blogger's published note list. That aligns with the declared sub-capability of '抓取某个博主的公开作品列表'. However, the broader description also claims the skill can search public notes and retrieve note details and comments, and none of those behaviors appear in this code. There is no evidence of unrelated or dangerous undeclared behavior, but there is a description-to-code mismatch because the declared purpose materially overstates the capabilities shown in the supplied chunk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
声明描述的是一个覆盖多项小红书运营数据能力的工具，但当前代码片段实际只涉及“公开笔记搜索”这一子功能：调用 note-search 接口创建搜索任务、轮询/获取搜索结果，并拼接笔记页与用户主页链接。代码中没有看到获取单篇笔记详情的接口调用、评论抓取逻辑，也没有博主作品列表抓取相关实现。因此，代码行为仅部分匹配声明，声明包含了当前代码片段未体现的多项核心能力，构成描述与行为不一致。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description promises a domain-specific Xiaohongshu data collection/analysis tool. However, the supplied code contains only utility functions for parsing command-line arguments and generating help text. It does not access Xiaohongshu, perform searches, retrieve note details/comments, scrape creator content, or analyze any data. While argument parsing could be a supporting utility inside a larger tool, this code chunk by itself does not implement the declared behavior and instead serves a materially different primary purpose.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared purpose centers on fetching and analyzing public Xiaohongshu content. However, this code chunk does not search notes, retrieve note details/comments, access network resources, or perform analytics. Its sole behavior is local log file creation and writing via fs. That is a materially different purpose from the declared description, and it introduces local filesystem write capability not reflected in the declared permissions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description promises a full Xiaohongshu public-content data/analytics tool. However, this code chunk contains only auxiliary terminal output functions for banners and logs. While logging can be a supporting detail, the provided code does not actually exhibit the described core capabilities at all. Based on this chunk, the actual behavior is materially narrower and different from the declared primary purpose.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 84% confidence
- Finding
The skill declares access to a sensitive environment variable (
GUAIKEI_API_TOKEN) but does not define an explicit tool scope such aspermissionsorallowed-tools. That weakens least-privilege controls and can let a runtime grant broader capabilities than the manifest makes clear, especially when the skill also instructs execution of local Node.js scripts.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The description and keywords are entirely in Chinese and target a specific Chinese platform, but the manifest provides no indication that this locale restriction is optional or intentionally limited to a region-specific audience. Under the policy, language or locale constraints should either offer user choice or be clearly documented and justified.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This code sends the provided API token as part of outbound HTTP request parameters when creating a detail task. Although the function has technical docstrings, there is no user-facing warning, confirmation, or disclosure here that credentials are being transmitted to an external API.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The task-result lookup performs a network call that includes both the API token and the user-supplied URL. The file contains error logging and technical parameter docs, but no visible warning or disclosure to the user that these potentially sensitive values are sent over the network.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Multiple error messages are hard-coded in Chinese, including operational guidance and support instructions, with no indication that the user can choose another language. This is a natural-language policy concern because the skill enforces a specific locale in user-visible strings without opt-in or documented justification.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The error path explicitly references the GUAIKEI_API_TOKEN environment variable, indicating the skill depends on a sensitive credential, but the code provides no docstring, comment, or other visible disclosure about accessing or relying on that credential. For code files, access to sensitive environment variables or credentials should have some user disclosure unless clearly documented elsewhere.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
This code performs outbound HTTPS POST requests and sends serialized request data, but there is no confirmation prompt, user-facing log/print, or explanatory comment/docstring disclosing that user or system data may be transmitted. Under the code-file criteria for SQP-2, network calls that transmit data should have some visible warning unless clearly covered elsewhere.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This JavaScript file contains comments and all user-visible error strings exclusively in Chinese, such as the validation errors printed to users. Because the file provides no opt-in, fallback, or documented region-specific justification, it appears to enforce a specific language in a way that can violate language/locale policy requirements.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The CLI silently writes fetched note and comment data to a local JSON file without explicit runtime consent or a clear execution-time warning. Even if the source content is public, persisted copies can accumulate sensitive business research, operator activity, or comment datasets on disk, increasing exposure through shared machines, backups, or downstream log collection.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This code invokes remote API methods to create and fetch a post task using the user-supplied URL and API token. Although the CLI prints the URL and mentions the required token, it does not clearly disclose that the input and related request data will be sent to an external service.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The code persists the final output to disk via log.taskWrite, and the saved JSON includes the request URL and returned results. There is no visible disclosure in the help text or comments that running the command will create a local file containing this data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
search.createSearchTaskandsearch.getSearchTaskperform network-backed search operations using the user's keyword and filters, which transmits user-provided data externally. While the CLI indicates that an API token is required, it does not clearly warn the user that their query data will be sent to a remote service.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The CLI writes full search output to a local JSON file named with user-controlled search terms, but the skill description only presents search/view/scrape behavior and this file gives no clear notice that data will be persisted locally. Local persistence increases privacy and data-handling risk because sensitive queries and results may remain on disk, be readable by other local users/processes, or leak through backups and logs.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill silently saves search results to a local file without warning the user in this file, creating an unexpected data retention behavior. Because search terms and returned content may reveal business research, competitor analysis, or personal interests, silent persistence can cause confidentiality issues if the host is shared or monitored.
- Content