Xiaohongshu (RedNote) Note Comments API

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:31 AM UTC
• Version: 1.0.0

Overview

This skill is narrowly aimed at fetching Xiaohongshu comments, but it handles the JustOneAPI token in ways that can expose the credential.

Review before installing. Use only with a JustOneAPI token you are comfortable sending to api.justoneapi.com, prefer a narrowly scoped or disposable token if available, and avoid running it in environments that log process arguments or full URLs. Be mindful that returned Xiaohongshu comment and author data may include personal information and should be handled accordingly.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: bin/run.mjs:235

Finding

API Token Exposed Through Command-Line Arguments and URL Query Parameters

Content

View full analysis

parameter.name === "token"); if (!tokenParam || params.token !== undefined) { return; } if (!cliToken) { fail("--token is required for this operation.", { operationId: operation.operationId, }); } params.token = cliToken; } ``` All parameters marked as query parameters—including the token—are appended to the request URL: ```js function applyQueryParams(operation, params, url) { for (const parameter of operation.parameters.filter((item) => item.location === "query")) { const value = params[parameter.name]; if (value === undefined) { continue; } appendValue(url.searchParams, parameter.name, value); } } ``` The resulting URL is transmitted to the fixed remote endpoint: ```js const baseUrl = manifest.baseUrl; const url = new URL(operation.path, ensureBaseUrl(baseUrl)); applyPathParams(operation, params, url); applyQueryParams(operation, params, url); const requestInit = { headers: { "accept": " ...[truncated 3192 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · bin/run.mjs (reported line 20)May include surrounding context.

js

"parameters": [
        {
          "defaultValue": null,
          "description": "Access token for this API service.",
          "enumValues": [],
          "location": "query",
          "name": "token",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · bin/run.mjs (reported line 78)May include surrounding context.

js

"parameters": [
        {
          "defaultValue": null,
          "description": "Access token for this API service.",
          "enumValues": [],
          "location": "query",
          "name": "token",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

This finding is valid because the skill directly requests an access token from the caller, creating a credential-handling surface. In this context the danger is amplified because the token is not only collected but designed to be sent to a third-party API endpoint, and the manifest provides no safeguards around storage, masking, or transmission.

Content

Scanner excerpt · generated/operations.json (reported line 15)May include surrounding context.

json

"parameters": [
        {
          "defaultValue": null,
          "description": "Access token for this API service.",
          "enumValues": [],
          "location": "query",
          "name": "token",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

This is another confirmed credential-access issue because the second operation also asks the caller to supply an access token. The skill context makes this more dangerous because it normalizes direct credential submission across endpoints, increasing the attack surface for accidental disclosure, logging, and misuse of the API account.

Content

Scanner excerpt · generated/operations.json (reported line 73)May include surrounding context.

json

"parameters": [
        {
          "defaultValue": null,
          "description": "Access token for this API service.",
          "enumValues": [],
          "location": "query",
          "name": "token",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The API requires an access token in the query string, which is a dangerous credential handling pattern because query parameters are commonly logged by servers, proxies, browser history, and monitoring systems. Exposure of this token could allow unauthorized use of the API service and compromise associated account access or billing.

Content

Scanner excerpt · generated/operations.md (reported line 19)May include surrounding context.

md

| Name | In | Required | Type | Default | Description |
| --- | --- | --- | --- | --- | --- |
| `token` | `query` | yes | `string` | n/a | Access token for this API service. |
| `noteId` | `query` | yes | `string` | n/a | Unique note identifier on Xiaohongshu. |
| `lastCursor` | `query` | no | `string` | n/a | Pagination cursor from the previous page (use the cursor value returned by the last response). |
| `sort` | `query` | no | `string` | `latest` | Sort order for the result set.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

This second endpoint repeats the same insecure design of placing the access token in a query parameter rather than a header or secret channel. Because both versions of the operation use the same pattern, any agent or integrator adopting this spec is likely to propagate credential leakage across logs and intermediaries.

Content

Scanner excerpt · generated/operations.md (reported line 49)May include surrounding context.

md

| Name | In | Required | Type | Default | Description |
| --- | --- | --- | --- | --- | --- |
| `token` | `query` | yes | `string` | n/a | Access token for this API service. |
| `noteId` | `query` | yes | `string` | n/a | Unique note identifier on Xiaohongshu. |

### Request body

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill invokes a network-capable helper (node {baseDir}/bin/run.mjs calling remote JustOneAPI endpoints) but does not declare any explicit tool scope such as permissions or allowed-tools. This creates a trust and policy gap: an agent may permit outbound requests without clear least-privilege constraints or reviewer visibility into what external access the skill requires.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill defines the API access token as a query parameter and later appends all query parameters directly to the request URL. Tokens in URLs are commonly exposed via logs, browser/history storage, proxy/CDN logs, monitoring systems, and referrer leakage, so this unnecessarily increases credential exposure risk even if HTTPS is used.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This is a manifest-style JSON file, so vague-trigger checks apply. The file describes the skill's purpose and operations in broad terms such as fetching note comments for analysis, but it does not specify any trigger phrases, activation boundaries, or negative examples that would clarify when the skill should or should not be invoked.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest explicitly advertises collection of comment text, author profiles, and timestamps for analysis, but provides no privacy notice, consent expectations, or handling constraints. This increases the risk that an agent will retrieve and process personal or user-generated content without adequate user awareness, especially since social-comment and profile data may contain sensitive personal information.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The API requires an access token as a query parameter and does not warn that this value is sensitive. Query-string credentials are commonly exposed through logs, browser history, telemetry, proxies, and referrer propagation, making credential leakage significantly more likely than if the token were sent in an authorization header or secure secret field.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This second operation repeats the same pattern of requiring a sensitive access token in the query with no disclosure about credential handling or external transmission. Repetition across multiple operations increases the likelihood of systemic credential leakage and insecure integrations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly enables collection of social-media comment text, author-related data, timestamps, and interaction data, but provides no warning, minimization guidance, or constraints around handling potentially personal or sensitive social data. In an agent context, this increases the risk of silent bulk profiling, sentiment monitoring, or surveillance use without informed user awareness or policy guardrails.

Content

No source excerpt is available for this finding.