Security audit

guaikei·小红书搜索·详情·评论·博主作品

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to perform the stated Xiaohongshu data-collection tasks, but it needs review because it sends the API token in URL query strings and automatically stores collected results locally.

Install only if you are comfortable sending Xiaohongshu keywords, URLs, and your Guaikei API token to the Guaikei service. Use a dedicated, revocable token, avoid sensitive research targets on shared machines, and periodically delete the local logs directory if retained search results or comments should not remain on disk.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: src/utils/request.js:87
Finding: API Credential Exposed in URL Query Strings
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (57)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documentation explicitly states that every execution is archived to local logs/...json files, but this storage behavior is not surfaced in the top-level capability declaration and may retain user-supplied links, keywords, and collected data. Undeclared persistence increases privacy and data-handling risk, especially for research workflows that may include sensitive targets or URLs.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The documentation explicitly states that every execution is archived to local logs/...json files, but this storage behavior is not surfaced in the top-level capability declaration and may retain user-supplied links, keywords, and collected data. Undeclared persistence increases privacy and data-handling risk, especially for research workflows that may include sensitive targets or URLs.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The documentation explicitly states that every execution is archived to local logs/...json files, but this storage behavior is not surfaced in the top-level capability declaration and may retain user-supplied links, keywords, and collected data. Undeclared persistence increases privacy and data-handling risk, especially for research workflows that may include sensitive targets or URLs.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The documentation explicitly states that every execution is archived to local logs/...json files, but this storage behavior is not surfaced in the top-level capability declaration and may retain user-supplied links, keywords, and collected data. Undeclared persistence increases privacy and data-handling risk, especially for research workflows that may include sensitive targets or URLs.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The documentation explicitly states that every execution is archived to local logs/...json files, but this storage behavior is not surfaced in the top-level capability declaration and may retain user-supplied links, keywords, and collected data. Undeclared persistence increases privacy and data-handling risk, especially for research workflows that may include sensitive targets or URLs.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The documentation explicitly states that every execution is archived to local logs/...json files, but this storage behavior is not surfaced in the top-level capability declaration and may retain user-supplied links, keywords, and collected data. Undeclared persistence increases privacy and data-handling risk, especially for research workflows that may include sensitive targets or URLs.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The documentation explicitly states that every execution is archived to local logs/...json files, but this storage behavior is not surfaced in the top-level capability declaration and may retain user-supplied links, keywords, and collected data. Undeclared persistence increases privacy and data-handling risk, especially for research workflows that may include sensitive targets or URLs.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The documentation explicitly states that every execution is archived to local logs/...json files, but this storage behavior is not surfaced in the top-level capability declaration and may retain user-supplied links, keywords, and collected data. Undeclared persistence increases privacy and data-handling risk, especially for research workflows that may include sensitive targets or URLs.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The description says the skill should trigger even when the user did not explicitly ask to search Xiaohongshu, as long as intent is loosely related to Xiaohongshu content acquisition. That is an overly broad activation rule that can cause the agent to invoke an external data-collection workflow unexpectedly, sending user prompts, keywords, or URLs to a third-party service without sufficiently explicit user intent.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.
md
- "看看这篇小红书笔记讲了什么、数据怎么样: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy'"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.
md
- "看看这篇小红书笔记讲了什么、数据怎么样: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy'"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.
md
- "看看这篇小红书笔记讲了什么、数据怎么样: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy'"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.
md
- "看看这篇小红书笔记讲了什么、数据怎么样: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy'"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.
md
- "分析这条小红书笔记评论区的主要观点: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.
md
- "分析这条小红书笔记评论区的主要观点: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.
md
- "分析这条小红书笔记评论区的主要观点: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.
md
- "分析这条小红书笔记评论区的主要观点: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.
md
- "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.
md
- "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.
md
- "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 118)May include surrounding context.
md
- "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill declares use of a sensitive environment variable (GUAIKEI_API_TOKEN) but does not declare an explicit tool/permission scope. That weakens reviewability and least-privilege controls, making it harder for operators to understand what secrets and capabilities the skill requires before execution.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill states that each execution is automatically archived to timestamped JSON log files, but users are not clearly warned up front about local retention of queries, URLs, and resulting content. Silent persistence can expose sensitive research activity, personal data in comments, or proprietary analysis targets to later disclosure on the host system.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README states that all task results are automatically saved to a local logs directory, but it does not provide a clear warning about persistence, retention, access controls, or how sensitive scraped content should be handled. Because this skill collects large volumes of public social-media data and may include URLs, comments, account identifiers, and analysis outputs, silent persistence increases the risk of unintended disclosure on shared machines, CI runners, or multi-user environments.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This code sends an API token and user-provided note URL to a remote endpoint via HTTP, which is a privacy- and security-relevant operation. While the function names and comments describe the API purpose, there is no visible confirmation prompt or user-facing disclosure in this file that user data and credentials are being transmitted.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:17