T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/request.js:76- Finding
API Credential Exposed in HTTP URL Query Strings
- Content
View full analysis
- Remediation
View remediation
Security audit
guaikei-xhs-search-and-track
Security checks for vulnerabilities and agentic risk
Overview
This skill largely does what it claims, but it needs review because it sends its API token in URL query strings and automatically saves fetched social-data results locally.
Review before installing if you will use a real or paid Guaikei token. The skill sends your keywords or Xiaohongshu URLs to www.guaikei.com, sends the API token in URL query strings, and saves returned data under logs/. Rotate tokens if they may have been logged, avoid sensitive investigations, and use the retrieved public user/comment data only where you have an appropriate basis and platform-compliant purpose.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (44)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description is specific to collecting structured public data from Xiaohongshu. The provided code, however, is only a constants/config file and points at www.guaikei.com, which is inconsistent with the stated target platform. While configuration files can be supporting code, this chunk alone does not evidence the declared Xiaohongshu functionality and instead references a different resource, which is a material mismatch under the evaluation criteria.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明描述的是一个面向小红书公开数据采集与分析的技能，但提供的代码仅是与业务无关的通用命令行参数解析器。它解析命令行选项、校验参数并生成帮助信息，属于底层辅助工具，而非所声明的核心功能实现。根据评估标准，当前代码块的实际行为与声明的主要用途存在明显且实质性的不一致，应判定为 mismatch。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
This code chunk does not implement the declared Xiaohongshu data retrieval behavior. Its primary function is writing arbitrary string content to local log files under a logs directory. While logging can be a supporting detail in a larger system, the supplied chunk itself exposes a concrete undeclared capability—local filesystem writing—and contains none of the declared platform-facing behaviors such as searching Xiaohongshu, fetching note details, comments, or creator posts. Therefore, the description does not accurately represent what this code chunk actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description presents a user-facing Xiaohongshu scraping/data-analysis capability. The supplied code chunk does not implement any of those behaviors. Instead, it is a small utility that accesses the local filesystem, loads package.json, and returns the package name. While such a helper could support a larger skill internally, based on this code chunk alone its behavior is materially different from the declared purpose and unrelated to Xiaohongshu content retrieval or analysis.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | 看某篇小红书笔记的评论数据 | `src/xiaohongshu/comment-cli.js` | 笔记 URL | 该笔记的评论内容、评论者信息、互动数据 |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | 看某篇小红书笔记的评论数据 | `src/xiaohongshu/comment-cli.js` | 笔记 URL | 该笔记的评论内容、评论者信息、互动数据 |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | 看某篇小红书笔记的评论数据 | `src/xiaohongshu/comment-cli.js` | 笔记 URL | 该笔记的评论内容、评论者信息、互动数据 |
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill declares an environment variable requirement (
GUAIKEI_API_TOKEN) but does not define any explicit tool scope such aspermissionsorallowed-tools. That weakens least-privilege controls and makes the skill's access to sensitive runtime capabilities less transparent to reviewers and enforcement layers.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The manifest description is entirely in Chinese and defines invocation conditions and usage expectations only in Chinese, without indicating that users may interact in other languages or choose a locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file presents all user-facing instructions, warnings, and usage details exclusively in Chinese. Under the policy rule for natural-language violations, forcing a specific language without giving the user a choice or documenting a justified locale constraint is a reportable issue.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
This markdown file instructs the skill to pull comment data for analysis, which affects third-party user data and privacy expectations. While it explains how to use the feature, it does not include a clear warning or disclosure that the skill retrieves public comment content and may process it for sentiment or opinion analysis.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The document presents competitor-account monitoring and KOL analysis as supported use cases, which can involve ongoing collection and analysis of account content. There is no accompanying warning about responsible use, data handling, or the fact that account content is being retrieved and analyzed.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This code sends a user-provided note URL and an API token to remote API endpoints via HTTP helper functions. While the function comments describe parameters, there is no confirmation prompt or explicit user-facing disclosure in the code that user data and credentials will be transmitted to an external service.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The function performs a network call that includes both the API token and note URL as request parameters to retrieve comment task results. The code lacks any visible user disclosure or confirmation that this data will be sent off-system, which is a safety-relevant behavior.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This code emits all user-facing warning and info messages in Chinese, including operational guidance and recovery instructions. Because the file provides no user opt-in, language selection, or documented region-specific justification, it violates the language/locale policy criteria for natural-language policy issues.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
All visible error messages in this file are hardcoded in Chinese, including operational guidance to check environment variables and contact support. Under the language/locale policy, forcing a specific language without opt-in or documented justification is a natural-language policy issue.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This helper serializes arbitrary data to JSON and sends it via HTTPS in postJson, but the file contains no confirmation prompt, logging, comment, or docstring warning that user or system data may be transmitted to a remote service. Because network transmission is safety-relevant under the rule, the absence of any disclosure in this code is a quality/safety gap.
- Content