Xiaohongshu (RedNote) Note Search API

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:50 AM UTC
• Version: 1.0.0

Overview

The skill does what it claims, but its JustOneAPI token handling exposes credentials through command-line arguments and URL query strings, so it should be reviewed before installation.

Install only if you are comfortable sending your Xiaohongshu search terms and JustOneAPI token to JustOneAPI. Prefer a short-lived, low-scope token, avoid logging command invocations or full request URLs, and rotate the token if it may have appeared in process logs, shell history, proxy logs, or API request logs.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: bin/run.mjs:192

Finding

API Token Exposed Through Process Arguments and URL Query Parameters

Content

View full analysis

Vulnerability Details

File Location: bin/run.mjs:17-27, 192-211, 260-270, 298-309, 341-349; SKILL.md:53-61
Vulnerability Type: Credential exposure through command-line arguments and URL query strings
Risk Level: Medium

Vulnerable Code

bin/run.mjs:17-27 defines the access token as a query parameter:

js

{
  "defaultValue": null,
  "description": "Access token for this API service.",
  "enumValues": [],
  "location": "query",
  "name": "token",
  "required": true,
  "schemaType": "string"
},

bin/run.mjs:192-211 adds all query parameters, including the token, to the URL and sends it:

js

const baseUrl = manifest.baseUrl;
const url = new URL(operation.path, ensureBaseUrl(baseUrl));
applyPathParams(operation, params, url);
applyQueryParams(operation, params, url);

const requestInit = {
  headers: {
    "accept": "application/json",
  },
  method: operation.method,
};

if (operation.requestBody && params.body !== undefined) {
  requestInit.body = JSON.stringify(params.body);
  requestInit.headers["content-type"] = operation.requestBody.contentType || "application/json";
}

let response;
try {
  response = await fetch(url, requestInit);

bin/run.mjs:260-270 accepts the credential as a process command-line argument:

js

if (flag === "--params-json") {
  parsed.paramsJson = value;
  index += 1;
  continue;
}
if (flag === "--token") {
  parsed.token = value;
  index += 1;
  continue;
}
fail(`Unknown argument "${flag}".`);

bin/run.mjs:298-309 transfers the command-line token into the request parameters:

js

function injectToken(operation, params, cliToken) {
  const tokenParam = operation.parameters.find((parameter) => parameter.name === "token");
  if (!tokenParam || params.token !== undefined) {
    return;
  }
  if (!cliToken) {
    fail("--token is required for this operation.", {
      operationId: operation.operationId,
    });
  }
  params.token = cliToken;
}

bin/run.mjs:341-349 serializes the tok ...[truncated 3462 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove command-line token handling. Read the credential directly from process.env.JUST_ONE_API_TOKEN so it is not included in the process argument vector.

js

const token = process.env.JUST_ONE_API_TOKEN;
if (!token) {
  fail("JUST_ONE_API_TOKEN is required.");
}

2. Use an authentication header. If supported by JustOneAPI, transmit the credential using an authorization header rather than a query parameter:

js

const requestInit = {
  method: operation.method,
  headers: {
    accept: "application/json",
    authorization: `Bearer ${token}`,
  },
};

3. Separate authentication from ordinary parameters. Remove token from the public operation parameter definitions and reject token inside --params-json. This prevents user-controlled parameter data from overriding the protected credential source.

4. If query authentication is mandatory, use short-lived and narrowly scoped tokens. Ensure the client, API gateway, reverse proxy, server, and monitoring systems redact the token query parameter from access logs, errors, traces, and telemetry.

5. Update the documentation. Replace the --token "$JUST_ONE_API_TOKEN" example with environment-only invocation and clearly document any unavoidable query-string exposure.

6. Rotate potentially exposed credentials. Tokens previously used through this helper should be rotated if process arguments, command execution, or request URLs may have been logged.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · bin/run.mjs (reported line 20)May include surrounding context.

js

"parameters": [
        {
          "defaultValue": null,
          "description": "Access token for this API service.",
          "enumValues": [],
          "location": "query",
          "name": "token",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · bin/run.mjs (reported line 107)May include surrounding context.

js

"parameters": [
        {
          "defaultValue": null,
          "description": "Access token for this API service.",
          "enumValues": [],
          "location": "query",
          "name": "token",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

The API requires an access token to be supplied as a query parameter, which is an unsafe credential-handling pattern. Query parameters are commonly logged by clients, proxies, analytics systems, browser history, and server infrastructure, increasing the likelihood of token exposure and unauthorized reuse.

Content

Scanner excerpt · generated/operations.json (reported line 15)May include surrounding context.

json

"parameters": [
        {
          "defaultValue": null,
          "description": "Access token for this API service.",
          "enumValues": [],
          "location": "query",
          "name": "token",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

This second operation repeats the same insecure pattern of transmitting the access token in the URL query string. Because the skill is an interface to an external API, this materially increases credential leakage risk across logging, monitoring, and intermediary systems.

Content

Scanner excerpt · generated/operations.json (reported line 102)May include surrounding context.

json

"parameters": [
        {
          "defaultValue": null,
          "description": "Access token for this API service.",
          "enumValues": [],
          "location": "query",
          "name": "token",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

The skill documents direct use of an access token in a URL query parameter, which is a credential exposure pattern because URLs are routinely captured in logs, monitoring systems, caches, and referer headers. In an API-integration skill, this is more dangerous because users may copy the example pattern directly into production workflows, causing persistent secret leakage.

Content

Scanner excerpt · generated/operations.md (reported line 19)May include surrounding context.

md

| Name | In | Required | Type | Default | Description |
| --- | --- | --- | --- | --- | --- |
| `token` | `query` | yes | `string` | n/a | Access token for this API service. |
| `keyword` | `query` | yes | `string` | n/a | Search keyword. |
| `page` | `query` | no | `integer` | `1` | Page number for pagination. |
| `sort` | `query` | no | `string` | `general` | Sort order for the result set.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

This second endpoint repeats the same unsafe credential pattern by requiring the access token in the query string, creating the same exposure surface across another API version. Repetition across versions increases the likelihood that insecure handling becomes entrenched across clients and documentation examples.

Content

Scanner excerpt · generated/operations.md (reported line 66)May include surrounding context.

md

| Name | In | Required | Type | Default | Description |
| --- | --- | --- | --- | --- | --- |
| `token` | `query` | yes | `string` | n/a | Access token for this API service. |
| `keyword` | `query` | yes | `string` | n/a | Search keyword. |
| `page` | `query` | no | `integer` | `1` | Page number for pagination. |
| `sort` | `query` | no | `string` | `general` | Sort order for the result set.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill invokes a network-capable helper (node {baseDir}/bin/run.mjs) and requires an API token, but it does not declare any explicit tool scope such as permissions or allowed-tools. That creates an authorization gap where a host agent may permit broader network access than intended, reducing reviewability and weakening least-privilege controls.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill requires an access token and places it in the URL query string when calling an external API. Query parameters are commonly exposed via logs, browser history, proxy/CDN logs, monitoring systems, and error traces, so this handling increases the chance of credential leakage even if TLS is used.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest exposes that both the user's search keyword and an access token are sent to an external service, but it does not disclose this data flow to the user. This is dangerous because users or integrators may unknowingly transmit sensitive search terms and credentials to a third-party API, creating privacy and secret-handling risks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation requires an access token to be sent as a query parameter but provides no warning that query strings are commonly logged by servers, proxies, analytics tools, browser history, and error reports. In a skill context, this can normalize unsafe credential handling and increase the chance that integrators expose long-lived API credentials during routine use.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The manifest text requires specific Chinese strings such as 一天内, 一周内, and 半年内 as accepted values, which imposes a language-specific interaction constraint. There is no accompanying opt-in, alternative localized values, or explanation that this locale restriction is required for a region-specific API.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This is a manifest-style JSON file, so vague-trigger review applies. The description says the skill is for searching Xiaohongshu notes by keyword, but it does not define any explicit invocation phrases, scope limits, or exclusion conditions, which can make activation criteria ambiguous in systems that infer triggers from manifest text.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The noteTime parameter exposes only Chinese-language enum values such as “一天内”, “一周内”, and “半年内”. This imposes a specific language/locale in the interface without offering a language choice or documenting why the locale restriction is necessary.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The noteTime parameter only documents Chinese-language enum values such as 一天内, 一周内, and 半年内, but the surrounding documentation does not explain that this endpoint is intentionally locale-specific or that users must opt into Chinese values. This can be a natural-language locale policy issue because it imposes a specific language constraint without explicit justification in the file.

Content

No source excerpt is available for this finding.