T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/request.js:76- Finding
API credentials and Xiaohongshu URL tokens are transmitted in query strings
- Content
View full analysis
- Remediation
View remediation
Security audit
guaikei-xhs-search-results
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent read-only Xiaohongshu data tool, but it exposes and stores token-bearing data in ways users should review before installing.
Install only if you are comfortable sending Xiaohongshu keywords, profile/note URLs, and a Guaikei API token to www.guaikei.com, and with results being saved locally under logs/. Avoid sensitive or long-lived token-bearing URLs, protect or delete generated logs, and prefer a version that sends credentials in an Authorization header and supports log redaction or opt-in output.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
src/utils/log.js:5- Finding
Collected social data and token-bearing URLs are automatically persisted in plaintext
- Content
View full analysis
|]/g, "_") .replace(/\.\.+/g, "_") .replace(/^\.+|\.+$/g, ""); if (safeFilename.length > 200) { safeFilename = safeFilename.substring(0, 200); } if (safeFilename === "") { safeFilename = `log_${Date.now()}`; } const outputFilename = path.join( path.dirname(__filename), "..", "..", "logs", safeFilename, ); try { await fs.promises.mkdir(path.dirname(outputFilename), { recursive: true }); await fs.promises.writeFile(outputFilename, content); utils.printSuccess(` → 已保存到 ${outputFilename}`); } catch (error) { utils.printError(`日志写入失败: ${error.message}`); } } ``` Successful search results are persisted without an explicit request from the user: ```js // src/xiaohongshu/search-cli.js:184-211 const finalOutput = { status: "success", error_code: "OK", message: "搜索任务完成", timestamp: new Date().toLocaleString(), request: { command: "search", keyword: keyword, type: type, sort: sort, time: time, limit: limit, }, skill_metadata: { skill_version: constants.VERSION, runtime_version: process.versions.node, execution_time: Dat ...[truncated 3005 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (45)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
声明描述的是一个覆盖搜索、笔记详情、评论、博主作品查询的综合性小红书数据技能；但提供的代码片段实际只处理“笔记关键词搜索”相关能力，包括创建搜索任务、查询搜索结果，以及拼接笔记和用户链接。代码中没有看到获取笔记详情、评论列表、博主作品列表的逻辑，也没有看到针对输入链接进行解析查询的实现。因此，代码行为明显比声明更窄，属于描述与实际行为不一致。未发现越权访问其他平台或登录相关操作。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
Based on the supplied code chunk, the implementation shown is only a constants/config file. The only concrete external resource referenced is www.guaikei.com, which is inconsistent with the declared purpose of operating on Xiaohongshu data. While a config file alone may be only part of a larger skill, this chunk does not evidence the declared behaviors (searching notes, fetching note details/comments, or listing creator works) and instead points to a different domain. Therefore this is a likely description-behavior mismatch for the provided code chunk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明描述的是一个面向小红书内容检索与数据读取的技能，但提供的代码仅是通用参数解析模块 args.js。它处理命令行选项、默认值、布尔参数、位置参数、帮助文本生成和错误提示，不涉及网络请求、链接解析、平台 API 调用、页面抓取、数据提取或任何小红书特定逻辑。因此代码的实际行为与声明的核心目的明显不一致，属于实质性不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明的用途是面向小红书内容检索与数据查看，而代码实际执行的是本地日志文件写入。它访问的是本地文件系统（fs/path），并不体现任何小红书搜索、详情抓取、评论查询或博主作品查询逻辑。虽然日志功能可能是辅助组件，但就该代码片段本身而言，其行为与声明的核心能力没有直接对应关系，属于明显的不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared purpose describes a Xiaohongshu data retrieval skill with user-facing capabilities around notes, comments, and creator works. The supplied code chunk does not implement any of these behaviors. Instead, it accesses the local filesystem to read package.json and returns the package name. This is materially different from the declared purpose and indicates a mismatch. While utility code can be supportive, this chunk by itself provides no observable implementation related to Xiaohongshu operations, and its actual behavior is unrelated to the declared functionality.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "只拉这条笔记的评论数据做观点归纳: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "只拉这条笔记的评论数据做观点归纳: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "只拉这条笔记的评论数据做观点归纳: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "只拉这条笔记的评论数据做观点归纳: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "只拉这条笔记的评论数据做观点归纳: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The manifest description is written as an instruction set entirely in Chinese and the file provides no indication that other languages are supported or that the user may choose their preferred language. Under the policy, forcing a specific language without opt-in can be a natural-language policy violation unless the locale restriction is documented and justified.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The README states that all task results are automatically saved under
logs/but does not clearly warn users that fetched note data, comments, keywords, and URLs may be persisted locally. This creates a real confidentiality and privacy risk because sensitive research targets, competitor monitoring activity, or personal data from public content can be unintentionally retained on disk and later exposed through backups, shared workstations, or source control mistakes.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest describes a read-oriented XiaoHongShu data skill limited to searching notes, viewing note details, fetching comments, and checking creator works. The changelog claims additional capabilities such as '评论情绪分析' (comment sentiment analysis), '博主作品监控' (creator works monitoring), and broader business analytics functions like competitor analysis, KOL screening, and trend monitoring, which exceed the manifest’s narrower purpose as stated.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The entire skill documentation is written in Chinese and all natural-language trigger examples are Chinese-only, with no indication that users may interact in other languages or that the locale restriction is optional. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is clearly documented and justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The file contains hard-coded user-facing strings entirely in Chinese, including instructions to contact a specific WeChat account to obtain a token. This imposes a specific language/locale on users without offering alternatives or opt-in, which matches the language/locale policy violation criteria.
- Content
Static analysis
Detected: suspicious.exposed_secret_literal
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- SKILL.md:16