T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/request.js:76- Finding
API Credential Transmitted in URL Query Strings
- Content
View full analysis
- Remediation
View remediation
Security audit
guaikei·小红书搜索与详情获取
Security checks for vulnerabilities and agentic risk
Overview
This skill appears to be a real Xiaohongshu research tool, but it needs review because its narrow comment-focused description conflicts with broader data-collection capabilities and it handles stored results and API tokens in risky ways.
Install only if you are comfortable sending Xiaohongshu keywords or links and your GUAIKEI_API_TOKEN to Guaikei's API, and with retrieved public data being saved locally under logs. Review the broader search, detail, comment, and creator-monitoring behavior despite the comment-only description, avoid sensitive workspaces, and rotate the API token if exposure through URL logging is a concern.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
src/utils/log.js:25- Finding
Retrieved Data Is Automatically Persisted in Plaintext Log Files
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (68)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The search workflow supports keyword-based discovery across Xiaohongshu rather than retrieval of comments for a specific note. In context, that broader harvesting capability is dangerous because it can be used for large-scale content collection while masquerading as a narrow comment-analysis utility.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The search workflow supports keyword-based discovery across Xiaohongshu rather than retrieval of comments for a specific note. In context, that broader harvesting capability is dangerous because it can be used for large-scale content collection while masquerading as a narrow comment-analysis utility.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The search workflow supports keyword-based discovery across Xiaohongshu rather than retrieval of comments for a specific note. In context, that broader harvesting capability is dangerous because it can be used for large-scale content collection while masquerading as a narrow comment-analysis utility.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The search workflow supports keyword-based discovery across Xiaohongshu rather than retrieval of comments for a specific note. In context, that broader harvesting capability is dangerous because it can be used for large-scale content collection while masquerading as a narrow comment-analysis utility.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The search workflow supports keyword-based discovery across Xiaohongshu rather than retrieval of comments for a specific note. In context, that broader harvesting capability is dangerous because it can be used for large-scale content collection while masquerading as a narrow comment-analysis utility.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The search workflow supports keyword-based discovery across Xiaohongshu rather than retrieval of comments for a specific note. In context, that broader harvesting capability is dangerous because it can be used for large-scale content collection while masquerading as a narrow comment-analysis utility.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The search workflow supports keyword-based discovery across Xiaohongshu rather than retrieval of comments for a specific note. In context, that broader harvesting capability is dangerous because it can be used for large-scale content collection while masquerading as a narrow comment-analysis utility.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The search workflow supports keyword-based discovery across Xiaohongshu rather than retrieval of comments for a specific note. In context, that broader harvesting capability is dangerous because it can be used for large-scale content collection while masquerading as a narrow comment-analysis utility.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The search workflow supports keyword-based discovery across Xiaohongshu rather than retrieval of comments for a specific note. In context, that broader harvesting capability is dangerous because it can be used for large-scale content collection while masquerading as a narrow comment-analysis utility.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The search workflow supports keyword-based discovery across Xiaohongshu rather than retrieval of comments for a specific note. In context, that broader harvesting capability is dangerous because it can be used for large-scale content collection while masquerading as a narrow comment-analysis utility.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The search workflow supports keyword-based discovery across Xiaohongshu rather than retrieval of comments for a specific note. In context, that broader harvesting capability is dangerous because it can be used for large-scale content collection while masquerading as a narrow comment-analysis utility.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The search workflow supports keyword-based discovery across Xiaohongshu rather than retrieval of comments for a specific note. In context, that broader harvesting capability is dangerous because it can be used for large-scale content collection while masquerading as a narrow comment-analysis utility.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The manifest claims a comment-only analysis skill, but the body documents multiple broader capabilities: keyword search, note detail retrieval, and creator post monitoring. Security review, user consent, and policy routing often rely on manifest metadata, so this discrepancy can lead to under-scoped approvals for a significantly more capable data-collection tool.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | 看某篇笔记的详情+评论 | `src/xiaohongshu/detail-cli.js` | 笔记 URL | `explore/` 或短链 |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | 看某篇笔记的详情+评论 | `src/xiaohongshu/detail-cli.js` | 笔记 URL | `explore/` 或短链 |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | 看某篇笔记的详情+评论 | `src/xiaohongshu/detail-cli.js` | 笔记 URL | `explore/` 或短链 |
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The README presents the skill as a broad Xiaohongshu data-mining and marketing suite, which materially exceeds the manifest's declared comment-analysis scope. This scope mismatch is dangerous because it can hide undeclared capabilities from reviewers and users, enabling overcollection of platform data or use of functions that were not approved or expected in the advertised skill context.
- Content