T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/request.js:82- Finding
API Token Exposed in URL Query Strings
- Content
View full analysis
- Remediation
View remediation
Security audit
xiaohongshu-tool
Security checks for vulnerabilities and agentic risk
Overview
The skill generally does what it advertises, but it automatically keeps collected data on disk and handles API/link tokens in ways that could leak them.
Review before installing. Use only data you are authorized to collect, assume your Guaikei token and submitted queries/URLs are sent to the provider, and treat the generated logs as sensitive because they may contain research targets, comments, profile data, and xsec_token-bearing Xiaohongshu URLs. Avoid running it on shared machines unless you can control and delete the logs.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
src/validate/url.js:21- Finding
Bypassable Xiaohongshu URL Allowlist Validation
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
src/utils/log.js:24- Finding
API Results and Access-Bearing URLs Archived in Plaintext
- Content
View full analysis
|]/g, "_") .replace(/\.\.+/g, "_") .replace(/^\.+|\.+$/g, ""); if (safeFilename.length > 200) { safeFilename = safeFilename.substring(0, 200); } if (safeFilename === "") { safeFilename = `log_${Date.now()}`; } const outputFilename = path.join( path.dirname(__filename), "..", "..", "logs", safeFilename, ); try { await fs.promises.mkdir(path.dirname(outputFilename), { recursive: true }); await fs.promises.writeFile(outputFilename, content); utils.printSuccess(` → Saved to ${outputFilename}`); } catch (error) { utils.printError(`Log write failed: ${error.message}`); } } ``` ```js // src/xiaohongshu/detail-cli.js:134-156 const finalOutput = { status: "success", error_code: "OK", message: "Comment task completed", timestamp: new Date().toLocaleString(), request: { command: "detail", url: url, limit: limit, }, skill_metadata: { skill_version: constants.VERSION, runtime_version: process.versions.node, execution_time: Date.now() - startTime, }, results: detailTask, }; console.log(JSON.stringify(finalOutput, null, 2)); utils.printSuccess(`Comment task completed and results were returned`); await log.taskWrite( `${startTime}_${validator.url2Name(url)}_detai ...[truncated 2676 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (40)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill presents itself as a Xiaohongshu data-insight tool, but the analysis indicates undisclosed local filesystem writes for logging and saving arbitrary string content. Hidden write behavior increases risk because users may invoke the skill expecting remote data retrieval, while it also persists data locally, which can expose scraped content, tokens, URLs, or sensitive user inputs to disk without clear consent.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill presents itself as a Xiaohongshu data-insight tool, but the analysis indicates undisclosed local filesystem writes for logging and saving arbitrary string content. Hidden write behavior increases risk because users may invoke the skill expecting remote data retrieval, while it also persists data locally, which can expose scraped content, tokens, URLs, or sensitive user inputs to disk without clear consent.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill presents itself as a Xiaohongshu data-insight tool, but the analysis indicates undisclosed local filesystem writes for logging and saving arbitrary string content. Hidden write behavior increases risk because users may invoke the skill expecting remote data retrieval, while it also persists data locally, which can expose scraped content, tokens, URLs, or sensitive user inputs to disk without clear consent.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README states that all task results are automatically saved to the local
logs/directory, but it does not prominently warn users that fetched public content, note details, comments, URLs, and analysis outputs may persist on disk. This can lead to inadvertent local retention of scraped content and potentially sensitive business research data, increasing exposure through shared machines, backups, or accidental redistribution.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill explicitly supports collecting public Xiaohongshu note details, comments, and competitor/KOL account posts, but the documentation does not warn about privacy expectations, platform terms, downstream data handling, or compliance constraints. Even when data is publicly accessible, bulk collection and analysis of comments or competitor content can create privacy, consent, and terms-of-service risk, especially if users repurpose the data for profiling, monitoring, or commercial intelligence without safeguards.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code file contains natural-language descriptions and runtime messages exclusively in Chinese, beginning with the module header and continuing in error/log strings. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified, which is not evident in this file.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This code sends the provided token in HTTP request parameters when creating a search task. Although the function has technical docstrings and retry logging, there is no user-facing warning or disclosure in this file that credentials are being transmitted to an external API.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The function performs an HTTP GET request containing the token and keyword/search filters, which may disclose user queries and credentials to a remote service. The file contains error logging but no user-facing notice that search data and the token are transmitted externally.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Multiple error messages in this file are presented only in Chinese, including operational and credential-related guidance, with no indication that users can select a language or that the skill is intentionally limited to a Chinese-speaking context. This is a natural-language policy concern because the file forces a specific language for user-facing output without documented opt-in or justification.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
This code performs outbound HTTPS GET and POST requests and serializes caller-provided parameters and JSON payloads for transmission, but the file contains no comments, docstrings, logging, or confirmation indicating that user or system data may be sent over the network. For code files, network calls that transmit data should have some visible disclosure unless the warning is documented elsewhere or clearly covered by the skill's stated purpose, which is not evident from this file alone.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This file contains user-facing Chinese text in the module comment and banner output, including the displayed product name at L08. Per the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly documented and justified, which is not present here.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The CLI persists fetched note details and comments to a local JSON file after printing results, which creates an additional at-rest copy of potentially sensitive or regulated data without explicit user consent or any retention controls. In a data-retrieval tool, silent local persistence increases exposure through shared machines, backups, log collection, or later unauthorized access.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The tool writes fetched note and comment data to a local JSON file without a clear prior warning or explicit consent path, so users may unknowingly create a persistent dataset on disk. This can expose scraped content to other local users, endpoint monitoring systems, or long-term storage beyond the user's expectation.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The CLI persists fetched creator-post results to a local JSON file after completing the request. While this appears to support logging or later analysis rather than malicious behavior, it creates undeclared data retention on disk, which can expose scraped content, metadata, or user query history to other local users, backups, or downstream processes. In the context of a data-collection tool, silent persistence increases privacy and compliance risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The tool writes result data to a local JSON file without an explicit user-facing warning at execution time or an opt-in control. Even if the fetched notes are public, the stored file may reveal search targets, collection timing, and assembled datasets that are more sensitive in aggregate than the source pages, especially on shared systems.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The CLI writes full search results to a local JSON file without making that persistence behavior clear to the user in normal execution flow. Even if the data is from public notes, results may still contain sensitive research targets, query intent, or collected profile information, creating unnecessary local data retention and possible leakage to other local users, backups, or logs.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The program silently saves search results to disk after completing what appears to be a query-only operation, with no user-facing warning in the main flow. This can surprise users and expose collected data or search intent through leftover files, especially on shared systems or in automated environments.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
This manifest is in scope for natural-language policy review, and its user-facing description and keywords are entirely Chinese with no indication that the skill is optional, multilingual, or limited to a Chinese-only audience. That can violate a language/locale policy when a skill implicitly forces one language without user opt-in or justification.
- Content
Static analysis
No suspicious patterns detected.