Security audit

xiaohongshu-zuopinpaqu

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does what it claims, but it handles an API token and saved crawl results in ways users should review before installing.

Install only if you are comfortable sending Xiaohongshu keywords, note/profile URLs, and your Guaikei API token to the Guaikei service. Use a dedicated, revocable token, avoid running it in shared workspaces, and periodically delete or protect the generated logs directory because results are saved automatically.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: src/utils/request.js:68
Finding: API Credential Exposed in URL Query Strings
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: src/validate/url.js:3
Finding: Bypassable Xiaohongshu URL Allowlist
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: src/utils/log.js:26
Finding: Collected Data and Capability-Bearing URLs Persisted in Plaintext
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (57)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documentation states that logs are automatically archived and static analysis indicates local filesystem writes to a logs directory, but this storage behavior is not clearly scoped or described in the skill metadata. Persisting scraped content, URLs, comments, or user-provided targets to disk can create unintended data retention and privacy exposure, especially in shared or multi-tenant environments.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The documentation states that logs are automatically archived and static analysis indicates local filesystem writes to a logs directory, but this storage behavior is not clearly scoped or described in the skill metadata. Persisting scraped content, URLs, comments, or user-provided targets to disk can create unintended data retention and privacy exposure, especially in shared or multi-tenant environments.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The documentation states that logs are automatically archived and static analysis indicates local filesystem writes to a logs directory, but this storage behavior is not clearly scoped or described in the skill metadata. Persisting scraped content, URLs, comments, or user-provided targets to disk can create unintended data retention and privacy exposure, especially in shared or multi-tenant environments.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The documentation states that logs are automatically archived and static analysis indicates local filesystem writes to a logs directory, but this storage behavior is not clearly scoped or described in the skill metadata. Persisting scraped content, URLs, comments, or user-provided targets to disk can create unintended data retention and privacy exposure, especially in shared or multi-tenant environments.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The documentation states that logs are automatically archived and static analysis indicates local filesystem writes to a logs directory, but this storage behavior is not clearly scoped or described in the skill metadata. Persisting scraped content, URLs, comments, or user-provided targets to disk can create unintended data retention and privacy exposure, especially in shared or multi-tenant environments.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The documentation states that logs are automatically archived and static analysis indicates local filesystem writes to a logs directory, but this storage behavior is not clearly scoped or described in the skill metadata. Persisting scraped content, URLs, comments, or user-provided targets to disk can create unintended data retention and privacy exposure, especially in shared or multi-tenant environments.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The documentation states that logs are automatically archived and static analysis indicates local filesystem writes to a logs directory, but this storage behavior is not clearly scoped or described in the skill metadata. Persisting scraped content, URLs, comments, or user-provided targets to disk can create unintended data retention and privacy exposure, especially in shared or multi-tenant environments.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The documentation states that logs are automatically archived and static analysis indicates local filesystem writes to a logs directory, but this storage behavior is not clearly scoped or described in the skill metadata. Persisting scraped content, URLs, comments, or user-provided targets to disk can create unintended data retention and privacy exposure, especially in shared or multi-tenant environments.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.
md
- "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.
md
- "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 241)May include surrounding context.
md
- "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.
md
- "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.
md
- "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 253)May include surrounding context.
md
- "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The manifest is specifically about crawling Xiaohongshu works by keyword. The README table states '获取抖音评论详情，分析舆情方向', which refers to Douyin comment retrieval and sentiment analysis, a different platform and a materially different capability.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: 清单描述声明该技能用于按关键词爬取小红书热门作品，并支持日期范围与排序筛选；但此文件的核心输入是“博主链接”，并围绕主页笔记任务执行，没有任何关键词、日期范围或排序参数。该行为属于不同的数据获取模式，和声明的技能用途存在明显语义偏差。
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: 代码中的参数说明、帮助示例和输出文案反复表述这是一个针对“博主主页链接”抓取“主页笔记”的工具，而不是关键词热门内容搜索。这里不仅是实现不同，连内嵌文案也直接表达了与技能描述不同的用途，构成显性的意图-代码分歧。
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 82% confidence
Finding: The skill declares access to an environment variable (GUAIKEI_API_TOKEN) but does not define an explicit tool scope such as permissions or allowed-tools. This weakens least-privilege guarantees and makes it harder for the host to constrain what the skill may access, especially for a third-party integration that transmits user-supplied URLs and queries to an external API.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README describes the tool as focused on Xiaohongshu data mining, competitor monitoring, and trend analysis. In the same 'core capabilities' section it lists retrieving Douyin comments, which conflicts with the stated single-platform Xiaohongshu focus and signals inconsistent intent documentation.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest says the skill is for crawling Xiaohongshu works by keyword with date-range and sort filters, returning structured tables. The README expands the skill’s purpose to competitor account monitoring, KOL screening, and comment analysis, including account-link and note-detail workflows that go beyond simple keyword-based work scraping.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: Automatically saving task results to logs/ can expose sensitive operational data such as searched keywords, target profile or post URLs, and harvested analysis output, especially on shared systems or in environments with weak file access controls. Because this skill is explicitly used for competitor monitoring and content intelligence, the stored logs may reveal confidential business intent and collected third-party data.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The changelog advertises capabilities beyond the stated skill scope, including note-detail/comment sentiment analysis and creator monitoring. Scope expansion in skill documentation is risky because it can mask undeclared data collection or agent behaviors, reducing operator visibility and making it easier for a skill to access or process more user or platform data than expected.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The documentation expands the skill from the manifest-described keyword-based scraping into three capabilities: keyword search, note detail/comments retrieval, and creator post enumeration. This scope mismatch can mislead operators and upstream agents into invoking broader data collection than users or policy reviewers expect, increasing the risk of unauthorized scraping or collection of profile/comment data.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This JavaScript file includes user-facing status and instruction strings entirely in Chinese, including the warning and follow-up guidance. Under the policy for natural-language issues, forcing a specific language without user opt-in is a locale/language policy violation unless the constraint is clearly documented and justified, which is not present here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Multiple user-visible error strings in this file are hard-coded in Chinese, such as 请求失败, 响应解析失败, and input validation messages. The policy requires avoiding forced language or locale unless the skill offers a language choice or clearly documents a justified locale constraint.
Content: No source excerpt is available for this finding.