T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/request.js:86- Finding
API Credential Exposed in URL Query Strings
- Content
View full analysis
- Remediation
View remediation
Security audit
guaikei-xhs-trending-finder
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly does what it claims, but it sends API tokens and Xiaohongshu links to a third-party service and automatically saves retrieved data locally without redaction.
Review before installing. Use this only for public Xiaohongshu data you are authorized to process, avoid sensitive links or query parameters, protect and rotate the Guaikei API token if exposed, and periodically delete or secure the generated logs directory.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
src/utils/log.js:27- Finding
Sensitive Request URLs and Retrieved Data Persisted in Plaintext Logs
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (52)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
The code is clearly related to Xiaohongshu and does not show unrelated or dangerous undeclared behavior. However, the declared description presents a broader skill covering note search, note details, comments, and blogger works. This code chunk only supports keyword-based note search and post-processing of returned note/user URLs. Since the evaluation is description versus supplied code chunk, the description overstates the implemented capabilities in this chunk, creating a material mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared purpose is specifically about interacting with Xiaohongshu content and metadata. The actual supplied code chunk is only a constants file and points to www.guaikei.com, which is inconsistent with the declared platform/resource. While constants alone may be supporting code, this chunk provides no indication of Xiaohongshu-related functionality and instead suggests use of another service/domain. Therefore, based on the supplied code, the description does not accurately match the observed behavior/resources.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明描述的是一个面向小红书内容检索与详情获取的技能，但给出的代码片段仅是基础工具层的 CLI 参数解析器，没有任何与小红书平台、笔记、评论、博主、网络请求、数据提取或链接处理相关的行为。该代码的实际主要用途与声明的技能目标 materially different，因此应判定为描述与行为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared purpose is a Xiaohongshu data access skill for retrieving notes, comments, and creator content. The supplied code does not perform any Xiaohongshu access, network requests, parsing, searching, or content retrieval. Instead, it writes provided content to the local filesystem in a logs directory. Local file writing is an undeclared capability and the code's primary purpose in this chunk is unrelated to the declared user-facing function. While logging can sometimes be a supporting detail, this isolated chunk exposes a general-purpose file write function rather than implementing Xiaohongshu retrieval behavior, so this is a clear description-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description says this skill interacts with Xiaohongshu content based on user keywords or links. However, the supplied code chunk is only a local utility that reads package.json from disk and returns the package name. That behavior is unrelated to searching Xiaohongshu notes, retrieving comments, or fetching creator works. While this may be a supporting utility within a larger project, based on the supplied code chunk alone its actual behavior does not match the declared end-user purpose.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | 看某篇小红书笔记的评论数据 | `src/xiaohongshu/comment-cli.js` | 笔记 URL | 该笔记的评论内容、评论者信息、互动数据 |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | 看某篇小红书笔记的评论数据 | `src/xiaohongshu/comment-cli.js` | 笔记 URL | 该笔记的评论内容、评论者信息、互动数据 |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | 看某篇小红书笔记的评论数据 | `src/xiaohongshu/comment-cli.js` | 笔记 URL | 该笔记的评论内容、评论者信息、互动数据 |
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The manifest declares use of an environment variable (
GUAIKEI_API_TOKEN) but does not define an explicit tool scope such aspermissionsorallowed-tools. In practice, this weakens least-privilege boundaries and makes it harder for a host platform to constrain what the skill may access, especially when secrets are involved.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The description uses broad activation language such as triggering whenever a user mentions Xiaohongshu and wants to 'understand content,' even without explicitly requesting search or data retrieval. Over-broad routing can cause the assistant to invoke an external-data skill unexpectedly, increasing the chance of unnecessary data disclosure to the third-party API or incorrect tool use.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This markdown file instructs users to pull public note details, comments, and competitor-account content for analysis, but it does not include any warning that the operation may process third-party content or potentially sensitive user-generated data. Under the markdown-file criteria for SQP-2, descriptions that affect privacy or user data should disclose those implications.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The environment/setup guidance requires configuring an external API token but does not disclose that user-supplied keywords or links may be transmitted to a third-party service. This creates a meaningful transparency and data-handling risk: operators may unknowingly send sensitive URLs, business research targets, or personal data embedded in links to an external provider.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This code sends potentially sensitive data, including a user-provided note URL and an API token, to remote API endpoints via HTTP requests. While the function comments describe parameters, they do not provide a user-facing warning or disclosure that data will be transmitted off-system.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The code performs a network request that includes an API token and request parameters tied to user content, but there is no visible confirmation prompt or user-oriented disclosure in this file. Under the rule, network calls that transmit user or system data should be flagged when no warning is present.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The function sends an API token and note URL in an HTTP request body/query context via postJson, which is a network transmission of potentially sensitive user or system data. Although the docstring names the token parameter, there is no explicit user-facing warning, confirmation, or disclosure in this file about transmitting credentials/data to a remote API.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
This function performs an HTTP request with token, URL, and limit parameters, which involves sending potentially sensitive data to an external API. The code includes retry error logging, but no user-facing warning or explicit disclosure that credentials and target data are being transmitted.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This file’s natural-language interface elements are Chinese-only, beginning with the top-level description and continuing through user-facing error/help strings. Under the policy, forcing a specific language without offering user choice or documenting a justified locale constraint is a natural-language policy violation.
- Content