T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/request.js:71- Finding
API Credential Transmitted in URL Query Parameters
- Content
View full analysis
- Remediation
View remediation
Security audit
xhs-content-scan
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly does what it claims, but it handles an API token and user-supplied URLs in ways that deserve review before installation.
Install only if you are comfortable sending Xiaohongshu queries, target links, retrieved public data, and your GUAIKEI API token to the third-party Guaikei service. Prefer a disposable or scoped token, review local logs after use, and avoid passing links from untrusted users until URL validation is hardened.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
src/validate/url.js:3- Finding
Xiaohongshu URL Allowlist Can Be Bypassed Using Embedded Substrings
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (45)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared purpose describes a higher-level competitor monitoring and analytics workflow: searching notes by keyword or listing a competitor account's posts, then comparing interaction data, content categories, and posting cadence. The supplied code does something narrower and different: it creates and queries an API task for a single Xiaohongshu note URL and retrieves note details plus comments. While this is still within the Xiaohongshu domain, the primary behavior does not match the stated monitoring/search/comparison functionality. In particular, comment retrieval is an undeclared capability, and the advertised analytics features are absent from this code chunk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description is about Xiaohongshu competitor monitoring and content analysis, but the supplied code chunk contains only a reusable command-line argument parsing utility. It does not perform keyword searches, fetch Xiaohongshu notes or blogger works, compare interaction metrics, analyze content types, or evaluate posting frequency. This is not merely a supporting implementation detail tied specifically to the declared function; it is generic infrastructure with no observable domain-specific behavior related to competitor monitoring in Xiaohongshu.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
声明描述的是一个面向小红书竞品内容监控与数据分析的技能，应涉及搜索笔记、获取博主作品、统计互动和内容分布等能力。实际代码片段没有任何与小红书、竞品搜索、数据抓取或分析相关的行为，只是在本地文件系统中写入日志文件。虽然日志功能可能是辅助实现细节，但当前提供的代码片段本身的实际行为与声明用途无直接对应，且包含未声明的本地文件写入能力，因此应判定为描述与行为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description promises Xiaohongshu competitor content monitoring and analysis features. However, the supplied code chunk contains only helper functions for printing a banner and formatted log messages. There is no evidence of search, data retrieval, analytics, platform interaction, or monitoring logic. Since the actual behavior in this chunk is materially different from the declared primary purpose, this should be flagged as a mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
声明描述的是一个‘竞品内容监控/分析’工具，重点在于搜索竞品笔记、获取博主作品列表，以及进行聚合对比分析。代码却只实现了一个 detail CLI：输入单条小红书笔记 URL，拉取该笔记的详情/评论任务结果，并返回 JSON。它没有体现关键词搜索、博主作品抓取、竞品监控、内容类型统计、发文频率分析或横向对比等能力。相反，代码的主要用途是单笔记评论抓取，这与声明的主要目的存在明显偏差，因此应判定为描述与行为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
The declared description promises a broader competitor monitoring/analysis tool with two acquisition modes: keyword search for competitor notes or direct retrieval of a competitor blogger's works list, plus comparative analysis of interaction metrics, content categories, and posting cadence. This code only implements the narrow 'directly get blogger works/posts list' part via a CLI parameter for a profile URL. It does not perform keyword search, competitor comparison, content strategy analysis, or metric aggregation/distribution analysis. The local file write is a minor extra implementation detail rather than the main mismatch. Overall, the actual behavior is materially narrower than the declared purpose, so this is a description-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
该代码块的核心功能是基于关键词执行小红书内容搜索，并返回结果 JSON。它确实与声明中的“按关键词搜索竞品相关笔记”部分部分一致，但没有看到任何获取指定博主作品列表、聚合互动数据、做分布统计、发文频率分析或竞品监控对比逻辑。代码也没有体现品牌方分析竞品内容策略的上层分析能力，只是一个底层搜索入口。因此，声明描述显著超出了此代码块实际实现的能力，属于描述与行为不一致。
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The package description is entirely in Chinese, which can impose a language/locale preference on users without any opt-in or alternative language support. Under the policy, language constraints should either offer user choice or be clearly justified as region-specific.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The manifest describes a skill focused on searching competitor-related notes and fetching competitor creators' post lists to compare engagement, content mix, and posting frequency. The README instead claims broader purposes such as爆款笔记挖掘, 趋势预测, and KOL筛选, which materially exceed the declared competitor-monitoring scope rather than merely explaining implementation details.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The manifest is specifically about monitoring competitor content strategies and traffic performance on Xiaohongshu. Line L25 states '获取抖音评论详情', introducing a different platform and a comment-analysis capability outside the manifest's stated Xiaohongshu competitor-monitoring behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README states that all task results are automatically saved under logs/ but does not clearly disclose that sensitive operational data such as searched keywords, target profile links, note URLs, and fetched content may be persisted locally. In a competitor-monitoring context, these logs can reveal research targets, business strategy, and collected third-party data to other local users, backup systems, or downstream tooling.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This markdown file uses only Chinese for the skill changelog and does not indicate that the skill is region-specific or that users may choose another language. Under the policy for natural-language issues, forcing a specific language without user opt-in can be a locale-policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This file's natural-language content, including module documentation and runtime error/retry messages, is entirely in Chinese, which indicates a fixed language choice. Under the policy, forcing a specific language without user opt-in or documented justification is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The user-facing strings at L22-L25 are written only in Chinese and the file provides no indication that language selection is optional or that the skill is intentionally limited to a Chinese-speaking context. This can violate language/locale policy requirements because the skill imposes a specific language on users without opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Several user-visible error strings are written only in Chinese, including operational guidance and support contact text. This may violate language/locale policy expectations because the skill does not offer a language choice or document a justified locale restriction.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code emits a fixed Chinese banner string as user-facing output, which imposes a specific language on users with no opt-in or alternative locale handling. The policy allows locale-specific behavior only when choice is offered or the constraint is clearly documented and justified, which is not evident in this file.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This JavaScript file contains comments and user-visible error messages entirely in Chinese, such as the validation errors printed via utils.printError. Under the natural-language policy rule, forcing a specific language without offering user choice or documenting a justified locale constraint is a policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code emits user-facing validation errors only in Chinese (for example at L05, L11, and L15), which forces a specific language on users. The policy explicitly flags language or locale constraints when they are imposed without offering a user choice or documenting a justified regional limitation.
- Content