T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/request.js:76- Finding
API Token Exposed in HTTP Query Strings
- Content
View full analysis
- Remediation
View remediation
Security audit
xhs-bloggertrack
Security checks for vulnerabilities and agentic risk
Overview
This skill appears to do the advertised Xiaohongshu research tasks, but users should review it because it sends an API token in request URLs and automatically saves full results locally.
Install only if you are comfortable sending Xiaohongshu keywords, target URLs, fetched public content, and your Guaikei API token to the Guaikei service. Treat GUAIKEI_API_TOKEN as a secret, avoid printing or pasting it into prompts or shared logs, and protect or delete the local logs directory after use because it may contain research targets and scraped results.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
src/xiaohongshu/detail-cli.js:137- Finding
Automatic Plaintext Persistence of Sensitive Query URLs and Retrieved Data
- Content
View full analysis
|]/g, "_") .replace(/\.\.+/g, "_") .replace(/^\.+|\.+$/g, ""); if (safeFilename.length > 200) { safeFilename = safeFilename.substring(0, 200); } if (safeFilename === "") { safeFilename = `log_${Date.now()}`; } const outputFilename = path.join( path.dirname(__filename), "..", "..", "logs", safeFilename, ); try { await fs.promises.mkdir(path.dirna ...[truncated 2433 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (58)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 84% confidence
- Finding
The code matches part of the description: it supports retrieving comments for a single Xiaohongshu note via task creation and result querying. However, the declared purpose also states the skill can scrape a blogger's public works list, which is not represented in this code. In addition, the analytical outcomes mentioned in the description are not implemented here and appear to be higher-level use cases rather than direct behavior. Because a significant declared capability is missing from the supplied code chunk, this is a description-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
代码文件 detail.js 的职责非常明确：调用 /api/xiaohongshu/detail/url 创建单篇笔记详情/评论任务，再调用 /api/xiaohongshu/detail/info 获取结果，处理后返回笔记详情、评论相关数据，并补充笔记页和用户主页 URL。它没有实现“某个博主的公开作品列表”抓取，也没有体现作者作品列表接口、分页遍历或作品集合处理逻辑。因此，声明描述了比当前代码实际行为更宽的核心能力，构成描述与行为不一致。不过，声明中的“搜索获取单篇笔记评论”与本代码部分一致。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 91% confidence
- Finding
The description advertises two core capabilities: 1) searching/getting comments for a single note, and 2) scraping a blogger's public works list. The supplied code chunk only covers the second capability by creating and querying a task for a blogger's published notes via /api/xiaohongshu/post/url and /api/xiaohongshu/post/info. There is no logic related to note comment retrieval, comment endpoints, note IDs, or comment parsing. Therefore the declared description overstates the implemented behavior in this chunk, creating a material description-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
描述宣称的两个主要能力是获取单篇笔记评论，以及抓取某个博主的公开作品列表。但代码中只有两个函数：createSearchTask 和 getSearchTask，调用的接口分别是 /api/xiaohongshu/note-search/keyword 和 /api/xiaohongshu/note-search/info，参数也围绕 keyword、type、sort、time、limit 展开，明确属于关键词搜索笔记结果的任务创建与查询。代码没有任何按笔记ID获取评论、按博主ID获取作品列表的逻辑，也没有相关接口、参数或数据处理流程。因此，声明与实际行为存在明显不符，且实际核心能力是关键词搜索而非描述中的评论抓取/博主作品抓取。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
该代码块是一个独立的通用参数解析模块（args.js），功能集中在读取和校验 CLI 输入、处理 help 文本，以及根据 schema 生成命令行帮助说明。这属于底层辅助基础设施，而不是所声明的业务能力本身。按照评估标准，单纯的支持性实现细节通常不应判为不匹配；但这里提供的代码块没有展示任何与小红书搜索、评论抓取、博主作品抓取或增长分析直接相关的行为，主功能与声明用途存在明显偏离。因此应判定为描述与实际代码行为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared purpose is about retrieving Xiaohongshu comments and public post lists for analysis. The actual code shown does not perform any network access, scraping, search, comment retrieval, blogger work listing, or analytics. Instead, it only writes arbitrary string content to a local log file in a logs directory after sanitizing the filename. Local logging can be a supporting detail in a larger system, but this specific chunk's behavior is materially different from the declared end-user functionality and represents an undeclared filesystem-write capability.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description promises Xiaohongshu content retrieval and scraping capabilities for analysis. The supplied code does not implement any of those functions. Instead, it performs a simple local filesystem read of package.json to obtain the package name. This is a materially different purpose and accesses a different resource type than implied by the description, so it should be flagged as a mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description presents a data acquisition/analysis skill for Xiaohongshu content and comments. However, the provided code chunk is just a generic utility module for terminal output and logging. Supporting utilities alone do not demonstrate the described behavior, and this chunk's primary behavior is unrelated to the declared end-user capability. Therefore this code chunk does not accurately represent the stated purpose.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
声明描述的是一个面向小红书内容抓取与分析的技能，核心能力应包括数据检索、评论获取、作品列表抓取或分析处理。而当前代码片段只是本地输入验证模块：检查关键词长度、特殊字符、http 链接，清洗关键词字符集，并校正搜索选项范围。这属于支持性实现细节，但如果仅依据该代码片段，其实际行为与声明的主要功能存在明显差距。代码没有显示任何网络请求、数据抓取、评论读取、博主作品访问或分析流程，因此该描述不能被该代码准确代表。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
声明描述涵盖“单篇笔记评论获取”和“博主公开作品列表抓取”两项核心用途，但该代码块只实现了评论获取相关功能。它要求传入的是笔记链接而非博主主页/博主标识，调用的也是 comment.createCommentTask 和 comment.getCommentTask，没有任何作品列表抓取、博主信息处理、作者主页解析或作品枚举逻辑。因此，代码行为只覆盖声明中的一部分，且遗漏了另一项被明确宣称的核心能力，属于描述与实际行为不完全一致的情况。未发现额外越权或无关的敏感能力；日志写入和 token 使用属于支持实现细节。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
从代码看，核心流程围绕
keyword/type/sort/time/limit参数展开，调用的是search.createSearchTask和search.getSearchTask，输出的是搜索结果列表。这说明该代码块的实际用途是内容搜索，而不是评论抓取或博主作品抓取。声明中描述了两类较具体的数据采集能力，但当前代码未显示相关输入（如笔记ID、博主ID）或对应 API 调用，因此属于描述与实际行为的实质性不一致。- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | 看某篇小红书笔记的评论数据 | `src/xiaohongshu/comment-cli.js` | 笔记 URL | 该笔记的评论内容、评论者信息、互动数据 |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | 看某篇小红书笔记的评论数据 | `src/xiaohongshu/comment-cli.js` | 笔记 URL | 该笔记的评论内容、评论者信息、互动数据 |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | 看某篇小红书笔记的评论数据 | `src/xiaohongshu/comment-cli.js` | 笔记 URL | 该笔记的评论内容、评论者信息、互动数据 |
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 84% confidence
- Finding
The skill declares use of an environment variable (
GUAIKEI_API_TOKEN) but does not define an explicit tool/permission scope such as allowed tools or data-flow boundaries. In an agent setting, this weakens least-privilege controls and can enable unintended access or propagation of secrets to third-party services without clear policy constraints.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The file’s user-facing description, instructions, examples, and trigger guidance are all presented in Chinese, which effectively forces a specific language/locale for use. The policy allows locale constraints only when users are given a choice or when the restriction is clearly documented and justified as region-specific; neither is stated here.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README explicitly says all task results are automatically saved to the
logs/directory, but it does not clearly disclose that user-supplied URLs/keywords and fetched third-party content such as notes or comments may be persisted locally. In this skill’s context, that can unintentionally store potentially sensitive research targets, marketing queries, or scraped content on disk, increasing the risk of local data exposure, retention beyond user expectations, and accidental sharing via backups or source control.- Content