T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/request.js:76- Finding
API Credential Exposed in HTTP Query Strings
- Content
View full analysis
- Remediation
View remediation
Security audit
guaikei·小红书公开笔记数据
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its Xiaohongshu research purpose, but it handles tokens and saved result data in ways users should review before installing.
Review this skill before installing if your Xiaohongshu research, note URLs, or Guaikei API token are sensitive. It sends requests to Guaikei and automatically saves returned data under logs/, so protect that directory, avoid committing it, delete old outputs when no longer needed, and consider rotating the API token if logs or infrastructure traces may have exposed it.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/log.js:25- Finding
Automatic Plaintext Persistence of Retrieved Data and Access-Bearing URLs
- Content
View full analysis
- Remediation
View remediation
` or `--save`. 2. Do not write result files during normal stdout-only operation. 3. Redact sensitive query parameters before printing or storing URLs: ```js function redactUrl(value) { const parsed = new URL(value); if (parsed.searchParams.has("xsec_token")) { parsed.searchParams.set("xsec_token", "[REDACTED]"); } return parsed.toString(); } ``` 4. Recursively redact fields named `token`, `xsec_token`, `authorization`, `cookie`, or similar before persistence. 5. Create files with owner-only permissions: ```js await fs.promises.mkdir(path.dirname(outputFilename), { recursive: true, mode: 0o700, }); await fs.promises.writeFile(outputFilename, content, { encoding: "utf8", mode: 0o600, flag: "wx", }); ``` 6. Allow users to select a secure output directory outside the source tree. 7. Add configurable retention and secure cleanup behavior. 8. Add `logs/` to `.gitignore` to reduce accidental publication, while recognizing that this does not replace access controls or redaction. 9. Document exactly what data is stored, where it is stored, and how users can delete it. 10. Add tests confirming that persisted output never contains raw API credentials or `xsec_token` values. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (58)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The manifest claims broad keyword-based list retrieval and comparative analysis, but the reported implementation centers on fetching details/comments from a single note link. This mismatch can lead to overcollection, mistaken invocation, and data being sent to an external provider without the level of user awareness that a narrower, accurate description would provide.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The manifest claims broad keyword-based list retrieval and comparative analysis, but the reported implementation centers on fetching details/comments from a single note link. This mismatch can lead to overcollection, mistaken invocation, and data being sent to an external provider without the level of user awareness that a narrower, accurate description would provide.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The manifest claims broad keyword-based list retrieval and comparative analysis, but the reported implementation centers on fetching details/comments from a single note link. This mismatch can lead to overcollection, mistaken invocation, and data being sent to an external provider without the level of user awareness that a narrower, accurate description would provide.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The manifest claims broad keyword-based list retrieval and comparative analysis, but the reported implementation centers on fetching details/comments from a single note link. This mismatch can lead to overcollection, mistaken invocation, and data being sent to an external provider without the level of user awareness that a narrower, accurate description would provide.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The manifest claims broad keyword-based list retrieval and comparative analysis, but the reported implementation centers on fetching details/comments from a single note link. This mismatch can lead to overcollection, mistaken invocation, and data being sent to an external provider without the level of user awareness that a narrower, accurate description would provide.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The manifest claims broad keyword-based list retrieval and comparative analysis, but the reported implementation centers on fetching details/comments from a single note link. This mismatch can lead to overcollection, mistaken invocation, and data being sent to an external provider without the level of user awareness that a narrower, accurate description would provide.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The manifest claims broad keyword-based list retrieval and comparative analysis, but the reported implementation centers on fetching details/comments from a single note link. This mismatch can lead to overcollection, mistaken invocation, and data being sent to an external provider without the level of user awareness that a narrower, accurate description would provide.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The manifest claims broad keyword-based list retrieval and comparative analysis, but the reported implementation centers on fetching details/comments from a single note link. This mismatch can lead to overcollection, mistaken invocation, and data being sent to an external provider without the level of user awareness that a narrower, accurate description would provide.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The manifest claims broad keyword-based list retrieval and comparative analysis, but the reported implementation centers on fetching details/comments from a single note link. This mismatch can lead to overcollection, mistaken invocation, and data being sent to an external provider without the level of user awareness that a narrower, accurate description would provide.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The manifest claims broad keyword-based list retrieval and comparative analysis, but the reported implementation centers on fetching details/comments from a single note link. This mismatch can lead to overcollection, mistaken invocation, and data being sent to an external provider without the level of user awareness that a narrower, accurate description would provide.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The manifest claims broad keyword-based list retrieval and comparative analysis, but the reported implementation centers on fetching details/comments from a single note link. This mismatch can lead to overcollection, mistaken invocation, and data being sent to an external provider without the level of user awareness that a narrower, accurate description would provide.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "拉这条笔记的评论做观点聚类: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "拉这条笔记的评论做观点聚类: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "拉这条笔记的评论做观点聚类: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This file adds comment-collection functionality that goes beyond the skill’s stated scope of searching public notes and returning note-level engagement metrics. Scope expansion is dangerous because it can collect more granular user-generated content than users and reviewers expect, increasing privacy, compliance, and platform-policy risk.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The manifest describes a skill for keyword-based discovery of public Xiaohongshu notes, including sorting and time filtering, but this file implements a separate workflow that accepts a note URL and fetches comments for that note. Retrieving comment content is materially different from searching note lists and comparing keyword performance, so this behavior goes beyond the described capability.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The manifest describes a skill for searching public Xiaohongshu notes by keyword, with ranking by likes/comments/favorites and time filtering. This file instead requires a '小红书博主链接' profile URL and creates a '主页笔记' task to retrieve notes from a specific creator homepage, which is a different user intent and data access pattern.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 87% confidence
- Finding
The skill declares access to an environment secret (
GUAIKEI_API_TOKEN) but does not define an explicit tool/permission scope. That weakens least-privilege boundaries and makes it harder for a host agent to reason about what capabilities the skill actually needs before invocation.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The description includes broad trigger phrases like "最近什么火" and "帮我找热门内容" even when the user does not explicitly mention Xiaohongshu. Overbroad activation criteria increase the chance that an agent routes unrelated social-media or general research requests into this skill, causing unintended third-party data transfer and scope creep.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README claims competitor monitoring, KOL screening, trend prediction, and comment analysis despite the manifest describing a narrower public-note keyword search tool. Overstating data collection and analysis powers is dangerous because it obscures true operational scope and may hide higher-risk data handling behaviors from users and platform reviewers.
- Content
Static analysis
Detected: suspicious.exposed_secret_literal
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- SKILL.md:17