T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/request.js:76- Finding
API Credential Transmitted in URL Query Strings
- Content
View full analysis
- Remediation
View remediation
Security audit
guaikei·小红书盯博主做监控
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly does what it says, but it handles an API token and saves retrieved social-media data in ways users should review before installing.
Install only if you are comfortable sending Xiaohongshu keywords, note links, profile links, and the Guaikei API token to the third-party Guaikei service. Treat the generated logs as sensitive research records, clean them up when no longer needed, avoid private or sensitive URLs, and prefer a version that sends credentials in headers and redacts saved xsec_token links.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
src/utils/log.js:24- Finding
Automatic Plaintext Retention of Complete API Results and Token-Bearing URLs
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (65)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
声明的核心能力是“小红书笔记关键词搜索”，面向话题/品类/词的检索场景；而代码实际调用的是
/api/xiaohongshu/comment/url和/api/xiaohongshu/comment/info，用于创建和查询评论抓取任务。其参数为url和limit，表明它针对单篇笔记的评论数据采集，不是搜索公开笔记，也没有体现返回标题、正文摘要、作者或跳转链接等搜索结果字段。这属于主要用途和访问资源类型的实质性不一致，应判定为描述与行为不匹配。- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
声明强调的是“小红书关键词搜索”能力，即围绕话题/品类/词检索相关公开笔记并返回搜索结果摘要。而代码仅处理 detail/url 和 detail/info 两个接口：输入是笔记链接 URL 与评论数量 limit，不是关键词；输出是单篇笔记详情及评论任务结果，还会构造笔记详情页和作者主页链接。这说明代码的主要用途是获取指定笔记的详情和评论，而不是搜索相关笔记。两者在输入形式、核心功能和输出内容上都有实质差异，因此属于明显不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
声明的核心能力是“关键词搜索小红书公开笔记”，适用于用户给出某个话题、品类或词来查看相关内容表现。但代码中仅看到 createPostTask(token, url, limit) 和 getPostTask(token, url, limit)，参数中心是博主URL与返回数量，接口路径和注释也明确指向“博主详情、已发布笔记模块”。这表明其主要用途是按博主页面获取其已发布笔记，而不是按关键词检索全站公开笔记。两者在输入方式、检索对象和使用场景上都存在实质差异，因此属于描述与实际行为不一致。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
声明描述的是一个面向小红书公开笔记搜索的技能，核心能力应包括接收关键词、访问小红书相关资源、检索内容并返回结构化搜索结果。而提供的代码块只是独立的通用参数解析工具函数（parseArgs/readValueAfterFlag/buildHelp），用于处理命令行选项和帮助文本，没有任何与小红书、搜索、社媒分析、内容提取或结果返回相关的实现。根据评估标准，这属于主目的明显不同且实际能力与声明不符的情况，应判定为 mismatch。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明描述的是一个面向小红书内容搜索与结果返回的技能，核心能力应包括网络检索、社媒内容解析和结果组织。然而提供的代码片段仅实现了本地日志落盘功能，使用 fs/path 在本地创建目录并写入文件，没有任何与小红书搜索、关键词检索、内容抓取、作者/互动数据提取或链接返回相关的逻辑。这不是单纯的辅助实现细节，因为代码展示的实际能力与声明的核心用途完全不同，且包含未声明的本地文件写入能力，因此应判定为明显不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
声明描述的是一个基于关键词搜索小红书公开笔记并返回内容摘要与互动数据的技能；但提供的代码片段没有任何搜索、请求、解析笔记内容或返回结果的逻辑。它只是在本地处理字符串，规范化 URL、判断是否为笔记链接或个人主页链接/短链，并生成一个名称标识。这属于与声明目标不同的基础工具代码。虽然这些函数可能是更大技能中的辅助实现，但就该代码片段本身而言，其实际行为与声明的核心用途明显不一致。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明描述的是“小红书关键词搜索”能力，核心输入应是关键词/话题，核心输出应是相关公开笔记信息。而提供的代码文件 comment-cli.js 的实际功能是“评论抓取”：它要求传入公开笔记链接（--url），可选评论数量（--limit），调用 createCommentTask/getCommentTask 获取该笔记的评论，并输出结果。代码中虽然帮助文本提到 search-cli.js 可能提供 URL，但当前代码本身并不执行关键词搜索，也不返回声明中的笔记搜索字段。因此该代码块的主要目的与声明明显不一致，属于实质性能力不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
声明描述的是“小红书关键词搜索”能力：根据关键词搜索公开笔记并返回标题、摘要、作者、互动数据和链接，适用于想看某词在社媒上的表现。代码片段实际实现的是 detail-cli：必填参数是 --url/笔记链接，可选 --limit/评论数量；它验证是否为小红书笔记 URL，然后创建并查询详情任务，最终返回单条笔记详情结果，并可拉取评论。虽然帮助文本提到该 URL 可能来自 search-cli 的输出，但当前代码本身并不执行搜索。因此其主要目的、输入形式和部分输出能力都与声明不一致，属于明显描述-行为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明的核心能力是“关键词搜索小红书公开笔记”，即基于搜索词检索相关内容。代码的核心行为却是接收一个小红书博主主页链接（--url），验证其是否为 profile URL，然后创建并获取该博主的主页笔记任务，最多按 limit 返回若干条结果。整个参数设计、帮助文案、URL 校验以及输出消息都明确表明这是“博主主页笔记获取”工具，而非“关键词搜索”工具。因此其主要目的、输入类型和适用场景都与声明明显不符，属于实质性描述与行为不匹配。
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这篇爆款笔记的详情和互动数据: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy'"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这篇爆款笔记的详情和互动数据: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy'"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这篇爆款笔记的详情和互动数据: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy'"
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The declared CLI scripts include 'post' and 'comment' operations, which indicate write-capable interactions despite the skill being described as a read-only search/monitoring tool. In context, this is more dangerous because hidden or undisclosed write paths could be invoked to publish content or interact with third-party accounts, creating risks of unauthorized actions, account abuse, or platform policy violations.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This CLI implements comment retrieval for a specific Xiaohongshu note, while the declared skill scope is limited to keyword-based search of public notes and returning note metadata. That scope mismatch is dangerous because it expands the data access surface beyond what users and platform reviewers would reasonably expect, enabling collection of user-generated comment content that may include personal data or sensitive information.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The implementation materially deviates from the declared skill purpose: instead of keyword-based discovery of public Xiaohongshu notes, it accepts a specific profile URL and retrieves a blogger's posts. That creates an undeclared targeted collection capability, which increases privacy/compliance risk and can mislead downstream users, reviewers, or policy controls that rely on the manifest to understand what the skill does.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 82% confidence
- Finding
The skill declares use of an environment secret (
GUAIKEI_API_TOKEN) but does not define an explicit tool/permission scope. That weakens least-privilege guarantees and makes secret use less transparent to reviewers and orchestrators, increasing the chance the skill is invoked with broader access than necessary.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger language is very broad (including implicit use whenever a user wants to understand a term's social-media performance), which can cause the skill to activate in contexts the user did not specifically intend. In a skill that sends queries and URLs to a third-party API, overbroad routing increases the chance of unnecessary data disclosure and incorrect tool use.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill admits that data is relayed through a third-party API, but the privacy implications are only mentioned late and without a strong upfront warning. Users may provide note URLs, creator profile links, or research targets without realizing this information is transmitted to an external service, creating consent and data-handling risks.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The package metadata advertises capabilities such as competitor monitoring, KOL filtering, precise marketing, and account growth that are materially broader than the declared skill purpose of keyword-based monitoring of public Xiaohongshu notes. This kind of scope mismatch is dangerous because it can conceal additional data processing or decision-support behaviors from reviewers and users, increasing the chance of unauthorized use, policy bypass, or misuse of the skill in higher-risk marketing workflows.
- Content
Static analysis
Detected: suspicious.exposed_secret_literal
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- SKILL.md:16