T09 · Insecure Skill Coding Practices
Warning
- Location
src/validate/url.js:21- Finding
Weak URL Allowlisting Permits Unintended URLs to Reach the Remote API
- Content
View full analysis
- Remediation
View remediation
Security audit
xhs-user-search
Security checks for vulnerabilities and agentic risk
Overview
This appears to be a real Xiaohongshu public-data tool, but it needs Review because it handles an API token and automatically stores collected data in ways that are broader and less protected than users may expect.
Install only if you are comfortable sending Xiaohongshu keywords, note/profile URLs, and your Guaikei API token to the third-party service. Treat generated logs as sensitive, delete or protect them after use, avoid passing tokenized links you do not want stored, and prefer a version that moves the API token to an authorization header, validates URLs structurally, and makes result saving explicit.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/request.js:71- Finding
API Credential Is Transmitted in URL Query Strings
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
src/xiaohongshu/detail-cli.js:133- Finding
Access-Bearing URLs and Collected Data Are Automatically Persisted in Plaintext
- Content
View full analysis
- Remediation
View remediation
` or `--save`; do not persist results by default. 2. Remove or redact sensitive URL parameters before printing or saving: ```js function redactUrl(input) { try { const parsed = new URL(input); for (const key of ["xsec_token", "token", "access_token", "api_key"]) { if (parsed.searchParams.has(key)) { parsed.searchParams.set(key, "[REDACTED]"); } } return parsed.toString(); } catch { return "[INVALID_URL]"; } } ``` 3. Recursively redact token fields and tokenized URLs in API responses before persistence. 4. Create the output directory with mode `0700` and files with mode `0600`: ```js await fs.promises.mkdir(path.dirname(outputFilename), { recursive: true, mode: 0o700, }); await fs.promises.writeFile(outputFilename, content, { mode: 0o600, flag: "wx", }); ``` 5. Use `flag: "wx"` or another collision-safe strategy to avoid unintended overwrites. 6. Define and document a retention period, and provide a cleanup command. 7. Add `logs/` to `.gitignore` and exclude it from CI artifacts and support bundles by default. 8. Where datasets are sensitive, support encryption at rest or require storage in a user-selected protected location. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (59)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The manifest markets the skill as a note-comment collector, but the usage examples and routing rules also support keyword-based content search over multiple posts. This misleading scoping can cause users or orchestrators to invoke a much broader crawler-like capability than intended, increasing privacy, compliance, and data governance risk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The manifest markets the skill as a note-comment collector, but the usage examples and routing rules also support keyword-based content search over multiple posts. This misleading scoping can cause users or orchestrators to invoke a much broader crawler-like capability than intended, increasing privacy, compliance, and data governance risk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The manifest markets the skill as a note-comment collector, but the usage examples and routing rules also support keyword-based content search over multiple posts. This misleading scoping can cause users or orchestrators to invoke a much broader crawler-like capability than intended, increasing privacy, compliance, and data governance risk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The manifest markets the skill as a note-comment collector, but the usage examples and routing rules also support keyword-based content search over multiple posts. This misleading scoping can cause users or orchestrators to invoke a much broader crawler-like capability than intended, increasing privacy, compliance, and data governance risk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The manifest markets the skill as a note-comment collector, but the usage examples and routing rules also support keyword-based content search over multiple posts. This misleading scoping can cause users or orchestrators to invoke a much broader crawler-like capability than intended, increasing privacy, compliance, and data governance risk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The manifest markets the skill as a note-comment collector, but the usage examples and routing rules also support keyword-based content search over multiple posts. This misleading scoping can cause users or orchestrators to invoke a much broader crawler-like capability than intended, increasing privacy, compliance, and data governance risk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The manifest markets the skill as a note-comment collector, but the usage examples and routing rules also support keyword-based content search over multiple posts. This misleading scoping can cause users or orchestrators to invoke a much broader crawler-like capability than intended, increasing privacy, compliance, and data governance risk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The manifest markets the skill as a note-comment collector, but the usage examples and routing rules also support keyword-based content search over multiple posts. This misleading scoping can cause users or orchestrators to invoke a much broader crawler-like capability than intended, increasing privacy, compliance, and data governance risk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The manifest markets the skill as a note-comment collector, but the usage examples and routing rules also support keyword-based content search over multiple posts. This misleading scoping can cause users or orchestrators to invoke a much broader crawler-like capability than intended, increasing privacy, compliance, and data governance risk.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The README materially expands the skill’s apparent functionality beyond the manifest description, advertising broad Xiaohongshu data mining, competitor monitoring, KOL screening, and trend analysis rather than just collecting public comments for a specific note. This scope mismatch is dangerous because it can mislead users, reviewers, and policy enforcement systems about what the skill actually does, reducing informed consent and potentially concealing higher-risk data collection behavior.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The documented workflows include keyword search and blogger account monitoring, which exceed the stated purpose of comment collection for one note. That mismatch increases security and trust risk because operators may grant access or approve the skill under narrower assumptions while the tool enables broader surveillance and data extraction capabilities.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The implementation does not match the skill’s declared purpose: it creates tasks for blogger published posts via /api/xiaohongshu/post/url instead of collecting public comments from a note. This kind of capability mismatch is dangerous because users and downstream agents may grant trust, permissions, or make decisions based on the manifest, while the code performs materially different data collection behavior.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The result retrieval path returns published-note task data from /api/xiaohongshu/post/info rather than comment data from a note’s comment section. In a security context, this is a scope-deception issue: consumers expecting comment scraping may unknowingly retrieve different profile/post data, causing unauthorized collection, policy violations, or misuse of the skill under false pretenses.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The manifest says this skill collects public comments from a specific Xiaohongshu note and returns structured commenter feedback data. This file instead defines input and output around a blogger profile URL and a limit for homepage notes, then creates and fetches a 'post' task for profile notes rather than comment extraction for a single note.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The manifest describes a skill for collecting public comments from a specific Xiaohongshu note and returning commenter nickname, likes, and comment text. This file instead implements keyword-based content search over notes/videos using filters like content type, sort, publish time, and limit, and returns search results rather than comment data from a specific note.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 80% confidence
- Finding
The skill declares access to an environment secret (
GUAIKEI_API_TOKEN) but does not define an explicit tool scope such as allowed tools or permissions. This weakens reviewability and least-privilege guarantees, making it harder to verify what the skill may access or exfiltrate when executed.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The skill description and all invocation guidance are written entirely in Chinese, including trigger examples and operational instructions, with no statement that other languages are supported or that the user may choose their preferred language. Under the policy, a skill that effectively enforces a specific language without opt-in is a natural-language locale violation unless the constraint is explicitly justified.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill manifest says this skill is for collecting public comments from a specific Xiaohongshu note and returning structured comment data. In contrast, the package description and keywords advertise broader capabilities such as mining viral posts, monitoring competitors, screening KOLs, traffic growth, and user profiling, which materially exceed the manifest's stated scope.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The file consistently describes a Xiaohongshu tool, but the comments-analysis row says '获取抖音评论详情', which refers to Douyin comments instead. This is an active documentation contradiction about the platform and intended data source, not merely an omission.
- Content