T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/request.js:76- Finding
API Credential Exposed in URL Query Strings
- Content
View full analysis
{ return await pos ...[truncated 3498 chars]- Remediation
View remediation
Security audit
guaikei·小红书搜索·详情·评论·博主
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its Xiaohongshu research purpose, but it handles access tokens and saved results in ways users should review before installing.
Install only if you are comfortable sending Xiaohongshu keywords, links, limits, and fetched public-content requests to Guaikei using your GUAIKEI_API_TOKEN. Treat generated logs as sensitive: review or delete artifact/logs after use, avoid shared workspaces, and rotate the API token if it may have been exposed through URL logs.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
src/utils/log.js:22- Finding
Automatic Plaintext Persistence of Access-Bearing URLs and Retrieved Data
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (52)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明描述的是一个面向小红书创作辅助的数据技能，核心能力应涉及小红书内容检索、热门数据分析或竞品风格提取。而提供的代码片段仅实现了通用命令行参数解析与帮助文本构建，属于基础工具代码，没有任何网络访问、平台数据读取、内容分析或与小红书相关的逻辑。两者主用途明显不一致，因此属于显著描述-行为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
声明描述的核心能力是提供小红书内容参考数据，但实际代码片段只处理API TOKEN的合法性校验和提示信息输出。这与所宣称的数据采集/分析用途不一致，至少在该代码片段中未体现任何与小红书内容、热门笔记、评论或竞品分析相关的行为。虽然TOKEN管理可能是支撑性实现细节，但当前提供的代码块本身的实际行为与声明的主要功能明显不匹配，因此应判定为不一致。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
声明描述的是一个面向小红书创作的数据参考技能，应涉及获取或整理小红书笔记、评论、竞品风格等内容。实际代码仅实现本地日志文件写入，没有任何小红书相关的数据访问、分析、检索或内容参考逻辑。虽然日志记录可能是辅助功能，但当前代码片段展示的唯一行为就是文件系统写入，这与声明的核心用途明显不一致，并体现了未声明的本地文件写入能力。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明的核心用途是提供小红书内容参考数据，需要具备抓取、读取、分析或返回高赞笔记、热门评论、竞品风格等能力。但提供的代码片段只使用 fs 和 path 读取本地 package.json，并导出一个返回包名的函数。该行为与小红书内容数据、创作选题支持或爆款参考均无直接关系，属于 materially different primary purpose，因此应判定为描述与行为不一致。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
该代码片段只是一个通用的重试辅助模块，用于包装异步操作并在失败时重试，带有指数退避和不可重试错误判断。它没有展示任何访问小红书、获取高赞笔记/热门评论/竞品风格、整理数据供创作参考等行为。虽然重试逻辑可能作为某些数据抓取功能的配套实现细节存在，但就此片段本身而言，其实际功能与声明描述的核心用途并不相符，因此应判定为描述与代码行为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
声明描述的是一个面向内容创作辅助的综合型小红书参考数据技能，核心能力应包括爆款参考、高赞笔记、热门评论、竞品风格等多维数据支持。但这段代码的实际功能非常具体且有限：它仅针对“小红书博主主页链接”创建任务并获取该博主的主页笔记数据，没有看到对评论的抓取、点赞排序的爆款识别、竞品风格分析，或任何创作参考层面的加工分析。因此，代码行为只覆盖了声明中的一小部分，且主要目的更像是“抓取某博主主页笔记数据”的 CLI 工具，而不是完整的选题/爆款参考技能。故应判定为描述与行为存在实质性不匹配。
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这篇爆款笔记的详情和互动数据: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy'"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这篇爆款笔记的详情和互动数据: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy'"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这篇爆款笔记的详情和互动数据: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy'"
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 87% confidence
- Finding
The skill declares access to an environment secret (
GUAIKEI_API_TOKEN) but does not define any explicit tool scope or permission boundary. That weakens least-privilege guarantees and makes it harder for a host system to constrain what sensitive inputs the skill may access or expose.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The description says the skill should be used even when the user did not explicitly ask for data, as long as they want inspiration from existing Xiaohongshu content. That broad trigger condition can cause the agent to invoke an external data-gathering integration unnecessarily, increasing privacy exposure and the chance of collecting or transmitting user-supplied content without clear intent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill acknowledges use of a third-party API but does not clearly disclose that user-provided Xiaohongshu links, keywords, and queried content will be transmitted to that external service. This creates a transparency and privacy risk: users may believe analysis happens locally or within the host platform, while their research targets and content are actually shared with another provider.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README states that all task results are automatically saved to a local logs/ directory, but it does not clearly warn users that search keywords, fetched URLs, note details, comments, and analysis outputs may be persisted on disk. For a tool used to gather competitor data and user-generated content, this creates a real confidentiality and data-retention risk because sensitive research inputs or scraped content can be exposed to other local users, backups, or downstream systems.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The changelog advertises a blogger post monitoring/scraping capability that goes beyond the manifest’s stated purpose of topic inspiration, popular notes, comments, and competitor style reference. This kind of scope drift is dangerous because users, agents, or policy layers may rely on the manifest for authorization and risk decisions, while hidden or undocumented scraping features enable broader collection of third-party content than expected.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The changelog claims KOL screening and trend monitoring capabilities that exceed the manifest’s narrower description. Mismatched capability disclosures weaken trust and can bypass human or automated governance, causing the skill to be invoked for profiling, monitoring, or competitive intelligence tasks that were not clearly reviewed or approved.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This JavaScript file contains user-facing natural language in comments, error messages, and help output exclusively in Chinese. The stated policy flags language or locale restrictions that force a specific language without user choice, and this file provides no opt-in, alternative locale, or justification for the constraint.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The user-facing strings are hard-coded in Chinese and the file provides no indication that language selection is optional or that the skill is intentionally limited to a Chinese-speaking region. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Multiple user-visible error messages are hard-coded in Chinese, including credential and request-failure guidance. This imposes a specific language on users without opt-in or an indicated locale-specific justification.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This code builds and sends outbound HTTPS GET and POST requests using caller-supplied params and data, which may include user or system information. Within this file there is no confirmation prompt, logging, comment, or docstring disclosing that data is transmitted off-system.
- Content