T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/request.js:76- Finding
API Credential Exposed in URL Query Strings
- Content
View full analysis
- Remediation
View remediation
Security audit
guaikei·小红书公开内容情报
Security checks for vulnerabilities and agentic risk
Overview
The skill broadly matches its Xiaohongshu research purpose, but it sends credentials and target data to a third-party API and automatically saves full results locally without strong controls.
Review before installing if you are comfortable sending Xiaohongshu keywords, note/profile URLs, limits, and your GUAIKEI_API_TOKEN to the Guaikei service. Use it only in a private workspace, avoid sensitive research targets, monitor and delete the generated logs directory when done, and rotate the API token if logs or request URLs may have been exposed.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/log.js:26- Finding
Sensitive URLs and Retrieved Data Persisted in Plaintext Log Files
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (75)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明描述的核心能力是“小红书笔记搜索与热度分析”，输入应是关键词，输出应是笔记列表及互动指标，并支持排序和时间筛选。而实际代码仅包含评论模块：
createCommentTask向/api/xiaohongshu/comment/url提交笔记链接和评论数量以创建评论任务，getCommentTask从/api/xiaohongshu/comment/info查询该任务结果并返回评论数据。其资源访问对象是单篇笔记URL对应的评论，而非关键词检索结果。该行为与声明的主要用途明显不同，且实现了未声明的“按URL获取评论”能力，因此应判定为描述与行为不一致。- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明描述的是一个“小红书关键词搜索/榜单筛选”能力：按关键词搜索公开笔记，并支持排序、时间筛选以及对多个关键词做表现对比。但提供的代码片段实际属于“小红书笔记详情和评论模块”，其核心行为是调用 /api/xiaohongshu/detail/url 创建任务，再调用 /api/xiaohongshu/detail/info 按 url 获取单篇笔记详情和评论结果，且会拼接笔记详情页和用户主页链接。代码中没有任何关键词检索、结果列表返回、排序字段、时间筛选或多关键词对比逻辑。因此该代码与声明用途存在明显且实质性的功能不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
声明描述的核心能力是“按关键词搜索小红书公开笔记并支持排序、时间筛选和热度分析”。但代码中没有任何关键词、排序、时间筛选相关参数或逻辑；相反，它围绕博主URL创建任务并查询该博主的已发布笔记结果，属于博主/账号维度的数据获取。虽然同属小红书数据，但主功能对象与使用方式均明显不同：声明是关键词内容检索，代码是博主已发布笔记抓取。因此存在实质性描述与行为不一致。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明描述的是一个面向小红书公开笔记的搜索与分析技能，应包含关键词检索、排序、时间筛选以及返回笔记互动数据等平台相关行为。但实际代码仅是 src/utils/args.js，一个与业务平台无关的通用 CLI 参数解析模块。它不访问小红书，不执行搜索，不处理笔记数据，也不实现排序/筛选逻辑。虽然这类工具函数可能作为更大技能的配套组件存在，但就所给代码片段本身而言，其实际行为与声明用途明显不一致。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
声明的核心用途是执行小红书公开笔记搜索与分析，但提供的代码片段并未实现任何与小红书、关键词检索、内容排序、时间筛选或互动数据返回相关的行为。其实际作用只是验证一个 GUAIKEI_API_TOKEN 是否符合格式，并在无效时提示联系微信获取私有 token。这不是单纯的底层辅助细节，因为从该片段能看到的行为与声明功能完全不一致，且包含额外的账号/令牌门控与推广性提示。因此该代码片段与声明描述存在明显不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared purpose describes a social-media research/search capability for Xiaohongshu public notes. The actual code chunk does not access Xiaohongshu, perform searches, process keywords, sort results, apply time filters, or return note/engagement data. Instead, it provides an auxiliary file-writing logger that writes content to a local logs directory. Local filesystem write access is an undeclared capability and the primary behavior is materially different from the declared purpose.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description says the skill searches Xiaohongshu public posts and returns ranked/filterable results with interaction data. The actual code chunk contains only a utility that uses fs/path to read package.json and return its name. This is materially unrelated to the declared primary purpose. While this could be a small helper within a larger skill, based on this supplied code chunk alone, the behavior shown does not match the described end-user functionality.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
这段代码只是一个工具模块，功能限于打印 banner 和按级别输出彩色日志，且输出目标是 stderr/console.error。根据给定代码片段，看不到任何网络请求、关键词处理、平台数据访问、搜索结果解析、排序筛选或互动数据汇总逻辑。因此，代码实际行为与声明的核心用途明显不一致。虽然日志工具可能作为更大系统的辅助模块存在，但就“所提供代码块实际做什么”而言，它并未体现声明中的主要能力，应判定为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
声明描述的是一个面向小红书公开笔记的搜索/调研技能，核心能力应包括关键词检索、结果排序、时间过滤以及输出笔记列表和互动指标。但提供的代码片段只包含 URL 处理工具：normalizeUrl 强制 https 并做基本格式检查，isNoteUrl/isProfileUrl 判断是否为小红书笔记或主页链接，url2Name 将 URL 转成安全名称。其主要用途是链接校验与命名，不是搜索或数据获取。并且代码支持识别个人主页 URL，这与声明中聚焦“按关键词搜索笔记”也不一致。因此该描述与代码实际行为存在明显不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明描述的是“小红书关键词搜索公开笔记”能力，核心输入应为关键词，核心输出应为笔记列表和互动数据，并支持排序与时间筛选。但代码实际实现的是 comment-cli：要求提供单个小红书笔记链接和评论数量限制，随后创建并查询评论抓取任务，输出评论结果。代码中没有任何关键词检索、排序、时间过滤或多笔记对比逻辑。虽然帮助文本提到 search-cli 可能产出该 URL，但这只说明它可作为另一工具的后续步骤，不能证明本代码具备搜索能力。因此描述与实际行为存在明显且实质性的不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
声明描述的是一个“小红书关键词搜索”技能：输入关键词，按互动指标排序、按时间筛选，返回笔记列表与互动数据，用于选题调研和热度对比。而实际代码是 detail-cli.js，核心参数是 --url/笔记链接 和 --limit/评论数量；它验证小红书笔记链接后，调用 detail.createDetailTask / getDetailTask 获取单条笔记详情及评论。代码中没有任何关键词搜索、排序、时间筛选、多关键词对比或列表检索逻辑。虽然同属小红书公开内容范围，但该代码块的主要用途与声明的主要能力明显不同，因此属于描述与行为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明描述的是“关键词检索小红书公开笔记”的能力，重点在搜索、排序、时间过滤和关键词研究场景。但代码实际要求输入的是小红书博主主页链接（profile URL），并调用 createPostTask/getPostTask 获取该博主主页笔记，主功能是抓取某个博主的主页笔记列表。代码中没有任何关键词参数，也没有点赞/评论/收藏排序、时间筛选或多关键词对比逻辑。虽然同属小红书公开内容范围，但主要用途和输入资源类型都与声明明显不符，因此属于实质性描述-行为不匹配。
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | 看某篇笔记的详情+评论 | `src/xiaohongshu/detail-cli.js` | 笔记 URL | `explore/` 或短链 |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | 看某篇笔记的详情+评论 | `src/xiaohongshu/detail-cli.js` | 笔记 URL | `explore/` 或短链 |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | 看某篇笔记的详情+评论 | `src/xiaohongshu/detail-cli.js` | 笔记 URL | `explore/` 或短链 |
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The file implements comment retrieval for a specific note URL, which is broader than the declared skill purpose of keyword-based public-note search, ranking, and trend comparison. This scope drift increases privacy and compliance risk because comment data may contain user-generated personal data and creates a capability users and reviewers would not reasonably expect from the manifest.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The implemented CLI behavior accepts a blogger profile URL and fetches that account’s posts, while the skill manifest says the skill searches public Xiaohongshu notes by keyword for trend/content research. This mismatch is security-relevant because upstream agents or users may grant the tool access and provide inputs under false assumptions, causing collection of different data than intended and bypassing policy or user-consent expectations.
- Content