T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/request.js:76- Finding
API Credential Transmitted in URL Query Strings
- Content
View full analysis
- Remediation
View remediation
Security audit
guaikei·小红书笔记与评论
Security checks for vulnerabilities and agentic risk
Overview
The skill appears to perform the advertised Xiaohongshu public-data analysis, but it needs review because it sends credentials and targets to a third-party API and automatically saves fetched results locally.
Review before installing. Use it only if you are comfortable sending search terms, Xiaohongshu URLs, and your Guaikei API token to guaikei.com, and remember that successful runs write result files under logs/. Keep the token private, avoid sensitive targets, restrict or clean the logs directory, and rotate the API token if you suspect it appeared in logs or shared workspaces.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
src/utils/log.js:5- Finding
Automatic Persistent Storage of Retrieved Data and Tokenized URLs
- Content
View full analysis
|]/g, "_") .replace(/\.\.+/g, "_") .replace(/^\.+|\.+$/g, ""); if (safeFilename.length > 200) { safeFilename = safeFilename.substring(0, 200); } if (safeFilename === "") { safeFilename = `log_${Date.now()}`; } const outputFilename = path.join( path.dirname(__filename), "..", "..", "logs", safeFilename, ); try { await fs.promises.mkdir(path.dirname(outputFilename), { recursive: true }); await fs.promises.writeFile(outputFilename, content); utils.printSuccess(` → 已保存到 ${outputFilename}`); } catch (error) { utils.printError(`日志写入失败: ${error.message}`); } } ``` Example invocation from `src/xiaohongshu/detail-cli.js`: ```js await log.taskWrite( `${startTime}_${validator.url2Name(url)}_detail.json`, JSON.stringify(finalOutput, null, 2), ); ``` The saved `finalOutput` includes the normalized request URL and the complete API response: ```js const finalOutput = { status: "success", error_code: "OK", message: "详情任务完成", timestamp: new Date().toLocaleString(), request: { command: "detail", url: url, limit: limit, }, skill_metadata: { skill_version: constants.VERSION, runtime_version: process.versions.node, execution_time: Date. ...[truncated 2451 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (42)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
There is a clear mismatch between the declared purpose and the provided code chunk. The description claims the skill accesses public Xiaohongshu note, comment, and creator-post data for analysis. However, the code shown contains only constants: a BASE_URL set to www.guaikei.com, request timing/retry parameters, and a version string. No logic is present for searching Xiaohongshu, parsing note URLs, fetching comments, or retrieving creator content. The referenced resource is also inconsistent with the declared target platform. While this may be only a partial file, based on the supplied chunk alone, the actual behavior does not substantiate the declared purpose.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明描述的是一个面向小红书公开内容采集与分析的技能，核心能力应包括访问小红书相关资源、抓取笔记/评论/博主作品并整理为结构化数据。而提供的代码仅是 src/utils/args.js 中的通用 CLI 参数解析器，负责读取命令行参数、校验 flag、处理布尔值、默认值、帮助信息等。这类代码最多是支持性基础设施，但当前给出的代码片段本身并未实现或体现声明中的核心业务能力。因此就“该代码块实际做什么”而言，与声明用途存在明显不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
声明描述的是一个面向小红书公开数据采集与分析的技能，核心能力应包括检索笔记、读取详情、评论与博主作品等。给定代码片段却仅实现了本地 token 格式校验和提示信息输出，且在 token 无效时引导用户通过微信获取私有 TOKEN。这与声明的主要用途明显不一致。虽然这可能是辅助模块而非全部实现，但就所提供代码而言，其实际行为与声明的核心功能不匹配，因此应判定为描述与代码行为存在明显偏差。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
This code does not perform any of the declared Xiaohongshu-related operations such as searching notes, retrieving note details/comments, or scraping creator post lists. Instead, it provides a generic file-writing/logging capability to the local filesystem. While logging can be a supporting implementation detail, this chunk’s behavior is solely about writing files and does not evidence the declared primary purpose. Therefore, based on this supplied chunk alone, the code behavior is materially different from the declared description.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "拉这条笔记的评论做观点聚类: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "拉这条笔记的评论做观点聚类: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "拉这条笔记的评论做观点聚类: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 80% confidence
- Finding
The skill declares access to a sensitive environment variable (GUAIKEI_API_TOKEN) but does not define an explicit tool scope such as allowed-tools or permissions. That weakens least-privilege guarantees and makes it harder for a host to constrain what the skill may access or execute, especially since the document directs command execution and external API use.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The trigger text is overly broad: it says the skill may apply even when the user did not explicitly mention Xiaohongshu or data retrieval, based on loose hints like '红笔记' or indirect goals. Broad invocation criteria can cause accidental activation on unrelated requests and unnecessary transmission of user queries or URLs to a third-party service, increasing privacy and data-minimization risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill depends on a third-party API service (guaikei.com) and the document only discloses this later under compliance/environment notes rather than upfront at the point of use. Users may provide URLs, keywords, and analysis targets without realizing that their inputs will be sent to an external provider, creating consent, privacy, and data-governance risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README states that all task results are automatically saved to the
logs/directory, but it does not clearly warn users that queried keywords, URLs, and returned content may be persisted locally. For a scraping and analysis skill handling competitor targets, note URLs, and comment data, this can create unintended local data retention, exposing sensitive research activity or copied public content to other local users, backups, or downstream tooling.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The changelog title is written in Chinese ("技能更新日志"), and the file provides no indication that users may choose another language or that the locale restriction is required for a region-specific purpose. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This code sends a user-provided API token and target note URL to a remote API via postJson, but the function contains no confirmation prompt or user-facing notice beyond technical docstrings. For code files, transmitting user or system data over the network should have some visible disclosure unless it is clearly surfaced elsewhere in the skill description, which is not evident in this file.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The getCommentTask function performs an HTTP request that includes the API token, URL, and limit parameters, but there is no confirmation prompt or user-facing disclosure describing this transmission. Retry error logging is present, but it does not warn the user about the network operation or data sent.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This file uses Chinese-only natural language in module comments, JSDoc descriptions, thrown error text, and retry log messages. Under the policy, forcing a specific language without offering user choice or documenting a justified locale constraint is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code includes user-facing error text in Chinese and does not offer any mechanism for language or locale selection. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Multiple thrown error messages are written only in Chinese, including the credential-related message on lines 34-35. This forces a specific language for user-visible output without opt-in or justification, which matches the language/locale policy violation criteria.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This JavaScript file contains natural-language comments and error messages exclusively in Chinese, such as the validation errors emitted to users. Because the file does not indicate that the skill is intentionally limited to a Chinese-speaking or region-specific context, this creates a language/locale policy concern by forcing a specific language without user opt-in.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The CLI persists fetched note details and comments to a local JSON file automatically after successful execution, without an explicit opt-in or warning at the point of use. Because the skill is designed to collect structured public content and comments for analysis, the saved output may still contain personal data, usernames, or sensitive research datasets, increasing the risk of unintended retention, local disclosure, or reuse beyond the user’s expectations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The CLI persists the full structured output, including the requested profile URL and scraped results, to a local JSON file without any consent flow, retention control, or redaction. In this skill context, scraped Xiaohongshu data may include identifiers, content metadata, and comments that can create privacy and compliance exposure if written to disk by default, especially on shared hosts or CI/agent environments.
- Content
Static analysis
Detected: suspicious.exposed_secret_literal
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- SKILL.md:17