Xiaohongshu (RedNote) Comment Replies API

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:29 AM UTC
• Version: 1.0.0

Overview

The skill is narrowly focused on a JustOneAPI RedNote comment-replies lookup, but it sends a reusable API token in the URL query string, which creates a real credential-exposure risk.

Review this before installing if your JustOneAPI token has broad scope, paid quota, or access to sensitive data. The skill appears purpose-built, but use a narrowly scoped token if possible and assume the token could be exposed anywhere full request URLs are logged by the API service or intermediaries.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: bin/run.mjs:25

Finding

API Access Token Exposed in URL Query String

Content

View full analysis

parameter.name === "token"); if (!tokenParam || params.token !== undefined) { return; } if (!cliToken) { fail("--token is required for this operation.", { operationId: operation.operationId, }); } params.token = cliToken; } ``` All parameters whose location is `query`, including the token, are serialized into `url.searchParams`: ```js function applyQueryParams(operation, params, url) { for (const parameter of operation.parameters.filter((item) => item.location === "query")) { const value = params[parameter.name]; if (value === undefined) { continue; } appendValue(url.searchParams, parameter.name, value); } } ``` The resulting URL, including the token, is sent to the remote service: ```js let response; try { response = await fetch(url, requestInit); } catch (error) { fail("Network request failed.", { cause: error instanceof Error ? e ...[truncated 2529 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

This finding reflects direct handling of an access token in a way that causes credential exposure because the token is treated as a normal query parameter. If captured from URL logs or intermediary systems, the token could let an attacker invoke the upstream API as the victim and access or consume protected service resources.

Content

Scanner excerpt · bin/run.mjs (reported line 20)May include surrounding context.

js

"parameters": [
        {
          "defaultValue": null,
          "description": "Access token for this API service.",
          "enumValues": [],
          "location": "query",
          "name": "token",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The manifest explicitly asks for an 'Access token' parameter, indicating the skill handles reusable credentials. In this context, the danger is increased because the token is not only collected but transmitted in the URL query string, raising the risk of credential exposure and subsequent unauthorized API use if logs or intermediaries capture it.

Content

Scanner excerpt · generated/operations.json (reported line 15)May include surrounding context.

json

"parameters": [
        {
          "defaultValue": null,
          "description": "Access token for this API service.",
          "enumValues": [],
          "location": "query",
          "name": "token",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · generated/operations.md (reported line 19)May include surrounding context.

md

| Name | In | Required | Type | Default | Description |
| --- | --- | --- | --- | --- | --- |
| `token` | `query` | yes | `string` | n/a | Access token for this API service. |
| `noteId` | `query` | yes | `string` | n/a | Unique note identifier on Xiaohongshu. |
| `commentId` | `query` | yes | `string` | n/a | Unique comment identifier on Xiaohongshu. |
| `lastCursor` | `query` | no | `string` | n/a | Pagination cursor from the previous page (use the cursor value returned by the last response). |

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill invokes a network-capable helper (node {baseDir}/bin/run.mjs) and is explicitly designed to call a remote API, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization gap where the runtime may permit broader tool or network use than reviewers and policy systems can reliably constrain, increasing the risk of unintended outbound requests or misuse if the skill is modified or composed with other agent behaviors.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill defines the API access token as a query parameter and automatically appends it to the request URL. Query-string secrets are commonly exposed through logs, proxies, browser/history artifacts, monitoring systems, and error reports, making accidental credential disclosure more likely even when HTTPS is used.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The API requires a sensitive access token to be sent as a query parameter, which is commonly exposed through logs, browser history, proxy caches, monitoring systems, and referrer leakage more easily than headers. Because the manifest provides no warning or safer authentication pattern, consumers may unknowingly handle credentials in an insecure way.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

This JSON manifest describes the skill in broad natural language but does not provide any explicit trigger scope, exclusion conditions, or negative examples. For manifest files, that can make activation criteria ambiguous if downstream systems use description text to determine when the skill should be invoked.

Content

No source excerpt is available for this finding.