T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/request.js:76- Finding
API Token Transmitted in URL Query Strings
- Content
View full analysis
- Remediation
View remediation
Security audit
guaikei·小红书采公开数据做增长
Security checks for vulnerabilities and agentic risk
Overview
The skill broadly matches its public Xiaohongshu data purpose, but it needs review because it handles credentials and collected results in ways that can expose them.
Install only if you are comfortable sending Xiaohongshu keywords, URLs, and retrieved public data through Guaikei's API. Use a dedicated, revocable GUAIKEI_API_TOKEN, avoid shared workspaces for sensitive research, and regularly delete or protect the generated logs directory.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
src/utils/log.js:5- Finding
Automatic Plaintext Retention of Complete API Results and Access-Bearing URLs
- Content
View full analysis
|]/g, "_") .replace(/\.\.+/g, "_") .replace(/^\.+|\.+$/g, ""); if (safeFilename.length > 200) { safeFilename = safeFilename.substring(0, 200); } if (safeFilename === "") { safeFilename = `log_${Date.now()}`; } const outputFilename = path.join( path.dirname(__filename), "..", "..", "logs", safeFilename, ); try { await fs.promises.mkdir(path.dirname(outputFilename), { recursive: true }); await fs.promises.writeFile(outputFilename, content); utils.printSuccess(` → 已保存到 ${outputFilename}`); } catch (error) { utils.printError(`日志写入失败: ${error.message}`); } } ``` Each successful CLI command writes the complete output automatically. For example: ```js await log.taskWrite( `${startTime}_${validator.url2Name(url)}_detail.json`, JSON.stringify(finalOutput, null, 2), ); ``` The search, comment, and profile-post commands use equivalent calls. ### Technical Analysis Successful API responses are serialized in full and automatically written to the project’s `logs/` directory. No explicit file mode is supplied, so confidentiality depends on the process umask and host configuration. There is also no retention period, cleanup mechanism, encryption, redaction, or option to disable persistence. The saved JSON can contain search ...[truncated 1738 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (69)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill is described as a creator-profile post-list tool, but it also performs general keyword/content search. That broader search capability changes the trust model and may lead to unintended collection or transfer of public content beyond the specific creator or URL the user thought they were authorizing.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill is described as a creator-profile post-list tool, but it also performs general keyword/content search. That broader search capability changes the trust model and may lead to unintended collection or transfer of public content beyond the specific creator or URL the user thought they were authorizing.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill is described as a creator-profile post-list tool, but it also performs general keyword/content search. That broader search capability changes the trust model and may lead to unintended collection or transfer of public content beyond the specific creator or URL the user thought they were authorizing.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill is described as a creator-profile post-list tool, but it also performs general keyword/content search. That broader search capability changes the trust model and may lead to unintended collection or transfer of public content beyond the specific creator or URL the user thought they were authorizing.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill is described as a creator-profile post-list tool, but it also performs general keyword/content search. That broader search capability changes the trust model and may lead to unintended collection or transfer of public content beyond the specific creator or URL the user thought they were authorizing.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill is described as a creator-profile post-list tool, but it also performs general keyword/content search. That broader search capability changes the trust model and may lead to unintended collection or transfer of public content beyond the specific creator or URL the user thought they were authorizing.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill is described as a creator-profile post-list tool, but it also performs general keyword/content search. That broader search capability changes the trust model and may lead to unintended collection or transfer of public content beyond the specific creator or URL the user thought they were authorizing.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill is described as a creator-profile post-list tool, but it also performs general keyword/content search. That broader search capability changes the trust model and may lead to unintended collection or transfer of public content beyond the specific creator or URL the user thought they were authorizing.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill is described as a creator-profile post-list tool, but it also performs general keyword/content search. That broader search capability changes the trust model and may lead to unintended collection or transfer of public content beyond the specific creator or URL the user thought they were authorizing.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill is described as a creator-profile post-list tool, but it also performs general keyword/content search. That broader search capability changes the trust model and may lead to unintended collection or transfer of public content beyond the specific creator or URL the user thought they were authorizing.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这篇爆款笔记的详情和互动数据: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy'"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这篇爆款笔记的详情和互动数据: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy'"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这篇爆款笔记的详情和互动数据: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy'"
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The README describes a substantially broader surveillance/data-mining tool than the manifested skill purpose of fetching a blogger’s public post list. This kind of scope drift is dangerous because an agent or reviewer may authorize a narrowly scoped skill while users are actually guided toward competitor monitoring, trend prediction, KOL screening, and other higher-risk collection uses.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This file implements creation and retrieval of comment-collection tasks for Xiaohongshu notes, which materially exceeds the manifest’s declared scope of listing a creator’s public works and evaluating per-post performance. That scope mismatch is dangerous because it enables collection of additional user-generated content not disclosed by the skill description, increasing privacy, compliance, and abuse risk for downstream profiling or scraping.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest says the skill is for obtaining a creator's public work list and using note details to assess single-post performance, and explicitly says it is used when a user wants to see what a creator posts and how often. This file instead creates and retrieves a comment task for an individual note and returns comment data, which is a materially different capability from listing a blogger's public works.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The implementation is a generic platform keyword search CLI, while the skill metadata says it should retrieve a specific creator's public work list from a homepage link. This scope mismatch expands data access beyond the declared purpose, enabling broad discovery and collection of unrelated public content and making the skill more dangerous because users and reviewers may trust it as narrowly scoped when it is not.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill declares access to an environment secret (
GUAIKEI_API_TOKEN) but does not define an explicit tool scope such aspermissionsorallowed-tools. That omission weakens least-privilege boundaries and makes it harder for the host to constrain what the skill may access or invoke, especially given it routes data to a third-party API.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The activation text says the skill may be used even when the user did not explicitly ask for blogger analysis, so long as they provided a homepage link and seem to want to view works. Overly broad activation criteria increase the chance of unintended skill invocation, unnecessary third-party data transfer, and user surprise about what data is being processed.
- Content
Static analysis
Detected: suspicious.exposed_secret_literal
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- SKILL.md:16