Xiaohongshu (RedNote) Note Details API

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:31 AM UTC
• Version: 1.0.0

Overview

The skill appears to do the advertised API lookup, but it handles the API token in ways that can expose it through URLs and process arguments.

Review before installing if the JustOneAPI token has broad or long-lived permissions. Use a narrowly scoped token, avoid environments that log command lines or full request URLs, and rotate the token if it may have been captured in process telemetry, proxy logs, or API gateway logs.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: bin/run.mjs:250

Finding

API access token exposed in the request URL query string

Content

View full analysis

parameter.name === "token"); if (!tokenParam || params.token !== undefined) { return; } if (!cliToken) { fail("--token is required for this operation.", { operationId: operation.operationId, }); } params.token = cliToken; } ``` ```js function applyQueryParams(operation, params, url) { for (const parameter of operation.parameters.filter((item) => item.location === "query")) { const value = params[parameter.name]; if (value === undefined) { continue; } appendValue(url.searchParams, parameter.name, value); } } ``` The embedded operation definitions designate the token as a query parameter: ```js { "defaultValue": null, "description": "Access token for this API service.", "enumValues": [], "location": "query", "name": "token", "required": true, "schemaType": "string" } ``` ### Technical Analysis The helper copies the API access token into `params.token`. B ...[truncated 2231 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: bin/run.mjs:218

Finding

API access token exposed through process command-line arguments

Content

View full analysis

"}' ``` The argument parser accepts and retains that value: ```js function parseArgs(argv) { const parsed = { operation: null, paramsJson: "{}", token: null }; for (let index = 0; index < argv.length; index += 1) { const flag = argv[index]; const value = argv[index + 1]; if (flag === "--operation") { parsed.operation = value; index += 1; continue; } if (flag === "--params-json") { parsed.paramsJson = value; index += 1; continue; } if (flag === "--token") { parsed.token = value; index += 1; continue; } fail(`Unknown argument "${flag}".`); } return parsed; } ``` ### Technical Analysis Although the token originates in the `JUST_ONE_API_TOKEN` environment variable, the recommended shell command expands it into the Node process's argument vector. Process arguments may be visible through operating-system process inspection, container or workload telemetry, execution auditing, endpoint monitoring, crash collection, and process-launch logging. The documentation states that token values should not be pasted into logs, but this does not prevent process-monitoring systems from recording the expanded `--token` argument automatically. Reading the already-required environment variable directly would avoid this additional exposure channel and better satisfy least-secret-exposure principles. ### Attack Path 1. The user stores a valid token in `JUST_ONE_API_TOKEN`. 2. The documented command expands the environment variable into `--token `. 3. The Nod ...[truncated 981 chars]

Remediation

View remediation

"}' ``` 3. Prefer injection through a platform secret manager rather than inline shell assignment where orchestration support is available. 4. Never include the token in error payloads, debug messages, telemetry attributes, or exception context. 5. Combine this correction with header-based API authentication so the token is exposed through neither process arguments nor request URLs. 6. Rotate any credentials known to have been executed in environments that retain process command lines or launch telemetry. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (15)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · bin/run.mjs (reported line 20)May include surrounding context.

js

"parameters": [
        {
          "defaultValue": null,
          "description": "Access token for this API service.",
          "enumValues": [],
          "location": "query",
          "name": "token",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · bin/run.mjs (reported line 57)May include surrounding context.

js

"parameters": [
        {
          "defaultValue": null,
          "description": "Access token for this API service.",
          "enumValues": [],
          "location": "query",
          "name": "token",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · bin/run.mjs (reported line 94)May include surrounding context.

js

"parameters": [
        {
          "defaultValue": null,
          "description": "Access token for this API service.",
          "enumValues": [],
          "location": "query",
          "name": "token",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · generated/operations.json (reported line 15)May include surrounding context.

json

"parameters": [
        {
          "defaultValue": null,
          "description": "Access token for this API service.",
          "enumValues": [],
          "location": "query",
          "name": "token",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · generated/operations.json (reported line 52)May include surrounding context.

json

"parameters": [
        {
          "defaultValue": null,
          "description": "Access token for this API service.",
          "enumValues": [],
          "location": "query",
          "name": "token",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · generated/operations.json (reported line 89)May include surrounding context.

json

"parameters": [
        {
          "defaultValue": null,
          "description": "Access token for this API service.",
          "enumValues": [],
          "location": "query",
          "name": "token",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

This operation explicitly asks for an access token, which means the skill handles credentials that can authorize external API use. Because the token is passed as a query parameter, it is especially susceptible to leakage through logs, request traces, monitoring systems, and copied URLs, creating a realistic credential-exposure risk.

Content

Scanner excerpt · generated/operations.md (reported line 19)May include surrounding context.

md

| Name | In | Required | Type | Default | Description |
| --- | --- | --- | --- | --- | --- |
| `token` | `query` | yes | `string` | n/a | Access token for this API service. |
| `noteId` | `query` | yes | `string` | n/a | Unique note identifier on Xiaohongshu. |

### Request body

Credential Access

High

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

This second version of the endpoint repeats the same credential-handling pattern by requiring an access token in the query string. Multiple exposed variants increase the attack surface and the chance that integrators will normalize insecure token transmission across the skill.

Content

Scanner excerpt · generated/operations.md (reported line 42)May include surrounding context.

md

| Name | In | Required | Type | Default | Description |
| --- | --- | --- | --- | --- | --- |
| `token` | `query` | yes | `string` | n/a | Access token for this API service. |
| `noteId` | `query` | yes | `string` | n/a | Unique note identifier on Xiaohongshu. |

### Request body

Credential Access

High

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

The v7 endpoint also requires a query-string access token, continuing the same insecure credential pattern. In a skill context, this is more dangerous because the file is operational documentation intended for users and agents, so it may directly encourage unsafe handling of reusable API credentials.

Content

Scanner excerpt · generated/operations.md (reported line 65)May include surrounding context.

md

| Name | In | Required | Type | Default | Description |
| --- | --- | --- | --- | --- | --- |
| `token` | `query` | yes | `string` | n/a | Access token for this API service. |
| `noteId` | `query` | yes | `string` | n/a | Unique note identifier on Xiaohongshu. |

### Request body

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill instructs the agent to invoke a Node helper that performs outbound API requests using a bearer token, but the manifest does not declare any explicit tool scope such as allowed-tools or permissions. This creates a trust and containment gap: an agent platform or reviewer cannot clearly constrain or audit the network capability from the skill declaration, increasing the risk of unintended external requests or misuse of the configured secret.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill defines the API access token as a query parameter, and the runtime appends all query parameters directly into the URL before issuing the request. Query-string credentials are commonly exposed via logs, browser/history tooling, proxies, error reports, and upstream analytics, making accidental credential disclosure much more likely even when HTTPS is used.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The API requires an access token to be sent as a query parameter to an external service, which is a risky credential-handling pattern. Query parameters are commonly logged by clients, proxies, gateways, and server access logs, increasing the chance of token leakage even if HTTPS is used.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The documentation requires an access token in a query parameter but provides no warning about secure credential handling. Query-string tokens are commonly exposed in logs, browser history, proxies, and analytics, so omission of guidance increases the chance that users will transmit or store credentials insecurely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill description does not warn users that the supplied noteId is sent to a third-party API for retrieval and analysis. This is primarily a transparency and privacy issue: users may unknowingly disclose identifiers or target content to an external provider.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The skill description states that note details, media, and engagement metrics are retrieved for analysis and archiving, but it does not warn users that content will be fetched from an external platform and may involve personal or copyrighted material. This can lead to unintentional privacy, compliance, or data-governance violations when users process third-party content without clear notice.

Content

No source excerpt is available for this finding.