T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/request.js:72- Finding
API Credential Exposure Through URL Query Parameters
- Content
View full analysis
- Remediation
View remediation
Security audit
guaikei·小红书多维数据工具
Security checks for vulnerabilities and agentic risk
Overview
The skill appears to do the Xiaohongshu data-collection work it advertises, but it needs review because it sends tokens and links to a third-party service and automatically saves collected data locally.
Install only if you are comfortable sending Xiaohongshu keywords, note/profile URLs, and your GUAIKEI_API_TOKEN to the Guaikei API. Treat the generated logs as sensitive: they can include investigated URLs, xsec_token-bearing links, comments, profile-linked data, and full collected results. Keep the workspace private, delete logs when no longer needed, avoid committing them, and rotate the API token if you suspect request URLs or logs were exposed.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
src/xiaohongshu/detail-cli.js:136- Finding
Automatic Plaintext Storage of Collected Data and Access-Bearing URLs
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (49)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
声明描述的是一个面向小红书的数据抓取技能，核心能力应包括访问小红书相关资源、执行搜索/详情/评论/博主作品获取，并输出结构化数据。但给出的代码片段仅实现了通用 CLI 参数解析与帮助文本生成，属于辅助基础设施代码。它既没有展示任何小红书特定逻辑，也没有数据抓取、解析、存储或汇总行为。根据评估标准，这不是单纯的支持性实现细节足以支撑声明主功能，而是代码片段的实际行为与声明用途存在明显偏离，因此应判定为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description says the skill retrieves Xiaohongshu content data such as search results, note details, comments, and creator works. However, the supplied code chunk does not implement any network access, scraping, API interaction, content retrieval, or structured data extraction. It only uses fs/path to locate package.json, read it, and return the package name. That is materially different from the declared primary purpose, so this code chunk does not accurately represent the described behavior.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看看这篇小红书笔记讲了什么、数据怎么样: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy'"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看看这篇小红书笔记讲了什么、数据怎么样: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy'"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看看这篇小红书笔记讲了什么、数据怎么样: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy'"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看看这篇小红书笔记讲了什么、数据怎么样: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy'"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 84% confidence
- Finding
The skill declares use of a sensitive environment variable (
GUAIKEI_API_TOKEN) but does not define any explicit tool scope or permission boundary. That makes secret usage less auditable and can allow broader-than-necessary execution context, increasing the chance of unintended secret exposure or misuse by the skill runtime or downstream commands.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The activation text says the skill should be used whenever a task involves obtaining Xiaohongshu data, even if the user did not explicitly request collection or scraping. That broad trigger can cause the agent to invoke data-harvesting behavior in situations where the user intent is ambiguous, leading to unnecessary third-party requests, overcollection, or policy/privacy issues.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill states that every execution automatically archives results to local
logs/...jsonfiles, but this persistence behavior is not surfaced as a prominent user warning in the main description. Silent local retention of retrieved content can expose scraped data, user-supplied URLs/keywords, and operational metadata to other local users, later processes, or accidental redistribution.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The README states that all task results are automatically saved to the logs/ directory, but it does not warn users that those logs may contain sensitive business inputs such as searched keywords, monitored account links, note URLs, and scraped comment data. In a data-collection skill, persistent local storage increases the risk of unintended disclosure through shared machines, backups, source-control mistakes, or later exfiltration by other processes.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
L42 明确写到“新增小红书笔记详情与评论情绪分析功能”，这超出了清单描述中“关键词搜索、笔记详情、笔记评论、博主作品抓取为结构化数据”的抓取/取回数据范围。情绪分析属于对获取数据进行额外分析处理，不是 manifest 当前声明的核心能力。
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
This markdown file instructs users to pull public Xiaohongshu note details, comment content, and creator post histories for analysis, including sentiment and competitor monitoring. Under the markdown-specific warning rule, it lacks any user-facing caution about handling third-party content, privacy expectations, or responsible use of scraped/analyzed data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This function sends an API token and a user-provided note URL to a remote endpoint via postJson, but the file contains only developer-facing docstrings and retry error logs. There is no confirmation prompt or user-facing disclosure that sensitive request data will be transmitted.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This function performs a GET request that includes the API token, note URL, and limit parameters, which may expose user or system data to a network service. The file does not provide any visible user-facing warning or confirmation about this transmission.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This code sends the
tokenparameter as part of an outbound HTTP request when creating a search task. Although the function comments describe the parameter technically, there is no confirmation prompt, user-facing warning, or explicit disclosure that a credential-like value will be transmitted to an external API.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The function performs a network call that transmits the user's search keyword together with the API token to a remote endpoint. For code files, safety-relevant network transmission of user/system data should have some visible disclosure, but this file only contains implementation details and retry error logging.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This JavaScript file contains natural-language comments and user-facing strings such as errors and help text entirely in Chinese. Because the file does not offer any user language selection or document that the skill is intentionally Chinese-only, it conflicts with the policy against forcing a specific language without user opt-in.
- Content
Static analysis
Detected: suspicious.exposed_secret_literal
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- SKILL.md:17