T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/request.js:76- Finding
API Credential Transmitted in URL Query Strings
- Content
View full analysis
- Remediation
View remediation
Security audit
guaikei·小红书搜索详情评论
Security checks for vulnerabilities and agentic risk
Overview
The skill broadly matches its Xiaohongshu data-analysis purpose, but it needs review because it sends API credentials and user inputs to Guaikei and automatically stores fetched results locally.
Review this before installing if your Xiaohongshu links, keywords, comments, creator research, or Guaikei API token are sensitive. Use a limited API token if possible, avoid private or regulated data, inspect and delete the generated logs directory regularly, and rotate the token if it may have been exposed through URL logs.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
src/xiaohongshu/detail-cli.js:139- Finding
Fetched Data and Access-Bearing URLs Persisted Automatically in Plaintext
- Content
View full analysis
|]/g, "_") .replace(/\.\.+/g, "_") .replace(/^\.+|\.+$/g, ""); if (safeFilename.length > 200) { safeFilename = safeFilename.substring(0, 200); } if (safeFilename === "") { safeFilename = `log_${Date.now()}`; } const outputFilename = path.join( path.dirname(__filename), "..", "..", "logs", safeFilename, ); try { await fs.promises.mk ...[truncated 2647 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (42)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明描述的是一个面向小红书公开内容采集与分析的技能，核心能力应至少体现为访问小红书相关资源、处理笔记/评论/博主数据或输出对应结构化结果。但提供的代码仅是一个通用 CLI 参数解析模块，负责读取命令行选项、校验参数、处理帮助文本，并不执行任何与小红书相关的搜索、抓取、解析或分析操作。虽然这类参数解析器可能是更大技能的辅助组件，但就该代码块本身而言，其实际行为与声明的主要能力明显不符，因此应判定为描述与代码行为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Yes, this is a mismatch. The declared purpose is about interacting with Xiaohongshu public content and returning structured data for analysis. The supplied code does not search Xiaohongshu, fetch notes, retrieve comments, scrape creator posts, parse links, or perform any content-analysis logic. Instead, it writes provided content to local log files on disk. While logging can be a supporting detail in a larger skill, this chunk’s actual behavior is solely a filesystem logging capability, which is undeclared and materially unrelated to the stated primary purpose of Xiaohongshu data collection.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Yes, this is a mismatch. The declared description is for a substantial Xiaohongshu public-content data extraction and analysis skill. The supplied code chunk does not implement any of those behaviors; it merely reads package.json from the local filesystem and returns the package name. While utility code can be a supporting detail, this specific chunk does not evidence the declared functionality at all and instead reflects a different, unrelated purpose (local metadata lookup).
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "拉这条笔记的评论做观点聚类: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "拉这条笔记的评论做观点聚类: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "拉这条笔记的评论做观点聚类: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 86% confidence
- Finding
The skill declares use of an environment secret (
GUAIKEI_API_TOKEN) but does not define an explicit tool/permission scope such as allowed tools or permission boundaries. That omission makes the secret exposure boundary unclear and increases the chance the runtime can access more capabilities than intended, especially in agent environments where undeclared env access weakens least-privilege controls.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The description includes broad activation criteria such as triggering even when the user did not explicitly mention Xiaohongshu, as long as terms like rednote/xhs or certain links appear. Over-broad routing can cause the agent to invoke external data-access tooling unexpectedly, sending user-provided queries or URLs to a third-party API without sufficiently clear user intent or minimization.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The README states that all task results are automatically saved to the
logs/directory, but it does not clearly warn users that fetched note content, comments, URLs, and keyword queries may be persisted locally. Because this skill is explicitly designed to collect and analyze third-party platform data at scale, automatic local retention increases the risk of unintentionally storing sensitive business research, personal data in comments, or regulated content beyond the user's expectations.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The documentation instructs users to provide content URLs and use a third-party API token, but it does not clearly warn that submitted URLs and fetched note/comment data will be transmitted to an external service. This creates a privacy and data-handling transparency gap: users may unknowingly send sensitive links, internal tracking parameters, or regulated content to an outside provider.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
This code sends an API token and the provided note URL to a remote endpoint via postJson, but the function contains no confirmation prompt, user-facing notice, or explicit warning beyond technical parameter annotations. For a code-file review under this rule, network transmission of user or system data should have some visible disclosure unless it is clearly surfaced elsewhere.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The getCommentTask function performs a network call that transmits the API token, URL, and limit parameters, but there is no confirmation, user-facing notice, or explanatory warning in the code comments beyond developer-oriented annotations. This is a relevant missing-warning case for network operations involving potentially sensitive data.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The manifest describes a skill for searching public Xiaohongshu notes, viewing details, fetching comments, and collecting public creator content, explicitly excluding actions beyond content retrieval. This utility creates directories and writes caller-provided content to local files under a logs directory, which is a persistent file-system side effect not necessary to the stated user-facing purpose of structured data retrieval and analysis.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
This code constructs and sends outbound HTTPS GET and POST requests, including serialized query parameters and JSON bodies, but contains no confirmation prompt, user-facing log/print, or explanatory comment/docstring disclosing that user or system data may be transmitted externally. For code files, network calls that transmit data should have some visible disclosure unless clearly covered elsewhere; no such warning is present in this file.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This JavaScript file contains user-facing validation/error messages entirely in Chinese, such as the messages at L08, L13, L17, L21, L25-L26, L54, L59, L64, and L68. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly justified, which is not present in this file.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The calls to createCommentTask and getCommentTask indicate network operations using the API token and user-supplied URL, but this file does not clearly disclose that the note link and request parameters are sent to a remote service. The help text mentions the required API token, yet it does not warn about transmission of user-provided data to that external endpoint.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The CLI persists full comment results to a local file after already returning them to stdout, which expands data retention beyond the stated user-visible purpose of fetching and returning structured Xiaohongshu data. Because comments may contain personal or sensitive content and the filename is derived from the queried URL, this creates an unnecessary local data-at-rest footprint that can be exposed to other local users, backups, or later processes.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
Writing scraped comment results to disk without an explicit user-facing warning or consent is a transparency and privacy issue. Users may reasonably expect the tool to print results only; silent persistence can lead to accidental retention of third-party content, leakage through shared machines, log collection, or forensic recovery.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The calls to
detail.createDetailTaskanddetail.getDetailTaskappear to transmit the provided URL, limit, and token to an external service, but the code does not explicitly warn the user that their input and related data will be sent over the network. The help text mentions the required API token, but it does not clearly disclose that note links and requested content are transmitted to a remote API.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The CLI writes the full task output, including fetched note details/comments and request metadata, to a local JSON file by default. This creates a privacy and data-handling risk because users may not realize potentially sensitive scraped content is being persisted on disk where it can be read later by other local users, backup systems, or adjacent processes.
- Content
Static analysis
Detected: suspicious.exposed_secret_literal
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- SKILL.md:17