Security audit

guaikei·小红书搜爆款

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it claims for Xiaohongshu data lookup, but it needs review because it sends credentials in URL query strings and automatically stores retrieved data locally.

Install only if you are comfortable sending Xiaohongshu keywords, note/profile URLs, retrieved content, and your Guaikei API token to the Guaikei service. Use a narrowly scoped token if possible, rotate it if exposed, avoid sensitive research in shared workspaces, and delete or protect the generated logs directory because results and access-bearing URLs are saved automatically.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: src/utils/request.js:88
Finding: API Credential Transmitted in URL Query Strings
Content: View full analysis
&... ``` HTTPS protects the request path against passive network interception, but it does not prevent the endpoint, reverse proxies, gateways, observability systems, request tracing tools, or diagnostic logs from recording the complete URL. URL query strings are routinely retained in infrastructure logs, whereas authorization headers can be centrally redacted more reliably. The problem affec ...[truncated 1374 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: src/xiaohongshu/detail-cli.js:132
Finding: Automatic Plaintext Persistence of Token-Bearing URLs and Retrieved Data
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (38)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.
md
- "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.
md
- "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 114)May include surrounding context.
md
- "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.
md
- "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.
md
- "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 131)May include surrounding context.
md
- "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.
md
- "看这篇爆款笔记的详情和互动数据: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy'"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.
md
- "看这篇爆款笔记的详情和互动数据: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy'"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.
md
- "看这篇爆款笔记的详情和互动数据: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy'"

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The description says the skill should be used whenever the user's goal is to make data-driven decisions with Xiaohongshu data, even if the user did not mention operations. This creates an overly broad trigger surface that can cause the agent to invoke the skill for loosely related requests, leading to unintended third-party API calls, unnecessary exposure of user-provided links or keywords, and reduced user intent fidelity. In this context, the skill accesses external data and requires an API token, so accidental activation is more risky than a purely local read-only helper.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The README states that all task results are automatically saved under a logs directory, but it does not clearly warn users that searched keywords, queried profile or note URLs, and retrieved content may persist on disk. For a data-scraping and competitor-monitoring tool, those logs can expose sensitive business research, marketing strategy, or collected third-party data to other local users, backups, or later unintended disclosure.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The document title and all operational instructions are written entirely in Chinese, with no indication that other languages are supported or that the user may choose a preferred language. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly documented and justified.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The function sends an API token and note URL to a remote endpoint via postJson, which is a safety-relevant data transmission. While parameters are documented for developers, there is no confirmation prompt or user-facing disclosure in the code indicating that user-supplied data and credentials will be sent over the network.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This function performs a network request with the API token, URL, and limit parameters to retrieve task results. The code includes retry error logging, but no user-facing warning that sensitive or identifying request data is being sent to an external service.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This JavaScript file contains natural-language documentation and runtime messages exclusively in Chinese, including comments and retry/error output. The file does not indicate that the skill is region-specific or that users can opt into this locale, which creates a language/locale policy concern under the stated rule.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The user-facing strings are entirely in Chinese and present warnings/instructions in that language only. This creates a language/locale policy issue because the skill does not offer any user choice, fallback, or documented justification for restricting communication to Chinese.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code contains user-facing error messages in Chinese and does not provide any language selection, fallback, or documented justification for a fixed locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The success and error messages shown to users are hard-coded in Chinese, which forces a specific language for runtime output. The file does not indicate that users can choose their language or that the skill is intentionally limited to a Chinese-speaking context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Multiple error messages in this file are hard-coded in Chinese, including operational and credential-related guidance, without offering a language choice or documenting that the skill is intentionally China/Chinese-locale specific. This is a natural-language policy issue because the skill imposes a specific language on users without opt-in or justification in the file.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The code explicitly references GUAIKEI_API_TOKEN, indicating the skill depends on a credential-like environment variable, but this file provides no user-facing explanation or warning about accessing/using such sensitive configuration. Under the rule, access to sensitive environment variables or credentials should have some disclosure through comments, logs, prompts, or skill documentation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This code serializes arbitrary data to JSON and sends it over HTTPS via postJson, but there is no confirmation prompt, log/print statement, or explanatory comment/docstring disclosing that user or system data will be transmitted. Because network transmission is a safety-relevant operation under the rule, the absence of any visible disclosure in this file is a valid missing-warning finding.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This code sends the user-supplied note URL together with an API token to a remote service to create and fetch a comment task, but the file does not present an explicit privacy or data-transmission warning. Even if this is expected functionality, users may not realize that the target URL and associated access token are transmitted to an external API, which can create privacy, compliance, or data-handling risks depending on the note contents and deployment environment.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The CLI persists fetched comment results to a local JSON file automatically, but this file does not provide a clear user-facing warning or opt-in before storing potentially sensitive scraped content on disk. Local persistence can expose data to other local users, backups, shell history workflows, or later unintended disclosure, especially because the filename is derived from the target URL and the contents include full results and request metadata.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The tool sends user-supplied note URLs and retrieves remote content using an API token, then writes returned data to stdout and to a local file, but does not clearly warn users about external transmission and persistence. In a scraping/detail-retrieval context, that omission increases privacy and compliance risk because operators may unknowingly exfiltrate or retain third-party data.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The CLI persists the full task output to a local file after fetching note details, which can include scraped content, comments, URLs, and metadata. This creates an unnecessary data-at-rest exposure risk because sensitive or regulated content may remain on disk without explicit user consent, retention controls, or access restrictions.
Content: No source excerpt is available for this finding.