Security audit

guaikei·小红书热门关键词

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to do its advertised Xiaohongshu data lookup work, but it should be reviewed because it sends an API token in URL query strings and automatically saves collected data and tokenized links locally.

Install only if you are comfortable with Guaikei receiving your API token, search terms, and Xiaohongshu URLs, and with returned data being saved under a local logs directory. Use a dedicated token, avoid shared or synced workspaces for sensitive research, delete generated logs when finished, and prefer an updated version that sends credentials in an Authorization header and makes redacted output saving opt-in.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: src/utils/request.js:83
Finding: API Credential Transmitted in URL Query Strings
Content: View full analysis
Remediation: View remediation
``` 3. Refactor the request helper to accept credentials separately from ordinary query parameters: ```js const options = { host: constants.BASE_URL, path: fullPath, method: "GET", headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}`, }, }; ``` 4. Configure reverse proxies, API gateways, and telemetry systems to redact both `Authorization` and any legacy `token` query parameter. 5. Avoid including request URLs or headers in user-facing errors and debug output. 6. Rotate credentials that have previously been transmitted through query strings, because historical logs may retain them. 7. Add automated tests asserting that generated request paths never contain `token=`, `GUAIKEI_API_TOKEN`, or the configured credential value. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: src/utils/log.js:4
Finding: Automatic Plaintext Persistence of Retrieved Data and Capability-Bearing URLs
Content: View full analysis
Remediation: View remediation
` or `--save`. 2. Do not save successful responses by default when they have already been emitted to standard output. 3. Recursively redact sensitive fields before writing: - `xsec_token` - URLs containing `xsec_token` - Any future API credentials, cookies, or authorization values 4. Create the log directory and files with restrictive permissions: ```js await fs.promises.mkdir(logDirectory, { recursive: true, mode: 0o700, }); await fs.promises.writeFile(outputFilename, redactedContent, { mode: 0o600, flag: "wx", }); ``` 5. Use exclusive creation where appropriate to prevent accidental overwriting or symlink-related file replacement in writable environments. 6. Implement configurable retention and automatic deletion of old files. 7. Add the `logs/` directory to source-control and packaging exclusions. 8. Clearly document what is stored, where it is stored, and how users can disable or remove it. 9. Add tests confirming that persisted output contains no `xsec_token`, API token, cookie, or authorization data. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (43)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 声明描述的是一个面向小红书公开内容采集与分析的技能，核心能力应包括访问小红书相关资源、检索内容、获取详情/评论/博主作品并返回结构化数据。但实际代码片段仅实现了通用 CLI 参数解析逻辑：读取 flag 值、处理布尔参数、校验重复和必填参数、生成帮助信息等。它没有体现任何小红书域名访问、内容抓取、JSON 数据获取、评论/笔记处理等行为。虽然这类工具函数可能是更大项目的配套组件，但就所给代码块本身而言，其实际行为与声明的主要功能明显不一致。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The declared purpose is a Xiaohongshu public-content data retrieval skill, but the supplied code does not search notes, fetch note details, retrieve comments, scrape creator posts, parse Xiaohongshu links, or return structured platform data. Instead, it validates filename/content inputs, sanitizes the filename, creates a local logs directory, and writes content to a file. Local logging can be a supporting implementation detail in a larger skill, but this chunk itself exposes a concrete undeclared capability—filesystem write access—and its primary behavior is unrelated to the declared externally facing purpose. Therefore this code chunk does not accurately represent the declared description on its own.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description promises a Xiaohongshu data collection and analysis capability, including searching notes, fetching details/comments, and retrieving public creator content. The supplied code chunk does none of that. It only imports fs and path, reads a local package.json file, and returns the package name. This is a materially different purpose from the declared skill behavior. While this may be a supporting utility within a larger project, based on the supplied code chunk alone it does not match the declared functionality.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.
md
- "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.
md
- "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 114)May include surrounding context.
md
- "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.
md
- "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.
md
- "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 131)May include surrounding context.
md
- "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.
md
- "看这篇爆款笔记的详情和互动数据: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy'"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.
md
- "看这篇爆款笔记的详情和互动数据: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy'"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.
md
- "看这篇爆款笔记的详情和互动数据: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy'"

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 86% confidence
Finding: The skill declares use of a sensitive environment variable (GUAIKEI_API_TOKEN) but does not define an explicit tool scope such as permissions or allowed-tools. That omission weakens least-privilege controls and makes it harder for a host agent to reason about what resources the skill actually needs before execution.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The activation text is broad enough to trigger on ambiguous references such as 'rednote' or indirect mention of links, which can cause the agent to invoke external data retrieval unexpectedly. Over-broad routing increases the chance of unnecessary third-party data transmission, surprising users and bypassing more precise intent confirmation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This file is a markdown skill reference, so SQP-2 applies. It repeatedly instructs users to fetch public note details, comments, and competitor/KOL post data for analysis, but does not include any warning that these actions collect third-party content, may involve privacy considerations, or should be used in compliance with platform rules and user expectations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: This function sends a token and user-provided URL to a remote API via postJson, which is a network operation involving potentially sensitive data. While the docstring describes parameters, it does not clearly warn the user that their token and target URL will be transmitted to an external service.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: This code performs an HTTP request that includes the API token, URL, and limit in the request parameters. The operation is visible in code, but there is no confirmation prompt or clear user-facing warning that sensitive or user-related data is being sent to an external endpoint.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This code sends the provided API token as part of HTTP request parameters when creating a search task. Although the function comments document the parameter, there is no user-facing warning, confirmation, or disclosure that sensitive credentials are being transmitted to an external API.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This function performs an HTTP GET request that includes the API token, keyword, and other search parameters. The code lacks a visible warning, confirmation, or user-facing notice that sensitive credential material and user-provided search data are being sent off-host.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This JavaScript file contains natural-language comments and user-facing CLI messages entirely in Chinese, including thrown errors and generated help text. Because the file does not provide any user opt-in, locale selection, or justification for being Chinese-only, it appears to enforce a specific language in violation of the language/locale policy criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code emits user-facing error messages only in Chinese, and the success/error strings indicate a fixed locale with no opt-in or fallback. That is a natural-language policy concern because the skill enforces a specific language rather than offering a user language choice or documenting a justified regional constraint.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This code builds and sends POST requests containing JSON-encoded data to a remote host via https.request, which can transmit user or system data externally. Within this file there is no confirmation prompt, logging, comment, or docstring warning users that data passed to postJson will be sent over the network.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This JavaScript file contains natural-language comments and error strings entirely in Chinese, such as the comment at L04 and multiple user-facing error messages from L08 onward. Because the file enforces a specific language for user interaction without any opt-in or documented justification, it violates the language/locale policy criterion.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The code reads a sensitive environment variable (GUAIKEI_API_TOKEN) and uses it in network operations through createCommentTask and getCommentTask. Although the tool's purpose implies remote API usage, the file does not explicitly warn users that the note URL and token-backed request data are sent to an external service, and the visible help text only mentions that the token must be configured.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This code persists the fetched comment data and request metadata to disk via log.taskWrite, which is a file-write operation covered by the warning requirement for code files. While the CLI logs progress, it does not clearly disclose to the user that results will also be saved locally, and there is no inline comment or docstring warning about that persistence behavior.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:16