T09 · Insecure Skill Coding Practices
Warning
- Location
batch_keyword.py:190- Finding
Excel Formula Injection Through Unsanitized Keywords
- Content
View full analysis
- Remediation
View remediation
Security audit
Xiaohongshu Keyword Batch Autocomplete
Security checks for vulnerabilities and agentic risk
Overview
The skill does not show theft or persistence, but it markets synthetic keyword reports as Xiaohongshu collection and has an Excel export safety issue.
Install only if you understand this version produces demo/mock keyword suggestions, not verified Xiaohongshu autocomplete data. Do not use its reports for real SEO, competitor, or business decisions unless the data source is corrected and clearly labeled; be cautious opening Excel exports made from untrusted keyword files.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (16)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill is presented as a Xiaohongshu autocomplete collection tool, but the documentation later admits the current implementation only generates mock data locally and does not perform real collection. This mismatch can mislead users into trusting fabricated outputs as genuine platform intelligence, which is especially risky in SEO, competitor analysis, or business decision workflows.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill documents capabilities consistent with file read, file write, and potential network access, but it does not declare any explicit tool scope such as permissions or allowed-tools. This weakens least-privilege controls and can allow the skill to be invoked with broader capabilities than users or the platform expect, especially since it reads keyword files and writes TXT/Excel exports.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger list contains broad generic terms like 'keyword', 'batch', and 'SEO', increasing the chance of accidental or ambiguous invocation in unrelated contexts. Unintended invocation can expose files, produce unwanted exports, or confuse users about which skill is acting.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The top-level documentation claims one-click retrieval of Xiaohongshu search suggestions, contradicting the later statement that only simulated data is used. This can deceive users at the initial trust boundary, causing them to run the skill under false assumptions about provenance and accuracy of the exported data.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The file explicitly states that the current version uses simulated data, while the rest of the skill markets it as a Xiaohongshu scraping/autocomplete collection tool. This is a security-relevant integrity issue because users may act on non-authentic outputs without realizing they are synthetic, undermining transparency and informed consent.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The tool advertises batch collection of Xiaohongshu autocomplete data, but the main collection path returns locally generated mock suggestions instead of real platform results. This is a security-relevant integrity issue because downstream users may trust fabricated output for SEO, research, or automation decisions, causing silent data poisoning and misleading analytics rather than an obvious runtime failure.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest describes a tool for batch importing keywords, performing deep rounds of autocomplete mining, and collecting long-tail terms for Xiaohongshu. The file content instead shows a highly repetitive fixed pattern for every seed keyword (e.g. '2025/新款/推荐/攻略/教程/平价/学生党/小个子/微胖/通勤' with descending heat scores), which indicates synthetic or placeholder output rather than actual platform-derived autocomplete data.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
该文档从标题开始即完全以中文提供说明，未见任何语言切换、英文替代说明或用户可选语言提示。按规则，强制单一语言且无用户选择属于自然语言层面的语言/区域策略问题。
- Content
Overly Broad Trigger
Low
- Category
- Trigger Abuse
- Confidence
- 78% confidence
- Finding
The trigger '选题' is very short and generic, making accidental matches more likely. In agent ecosystems, overly broad short triggers can route unrelated requests to this skill, leading to unintended execution or file output behavior.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The markdown explains export features and output directories, but it does not clearly warn users that running the skill will create files on the local filesystem. Because markdown files should disclose behaviors affecting user data or system state, the absence of an explicit warning about file creation is a documentation gap.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The code sets the Accept-Language header to prefer zh-CN and zh for all requests. This is a natural-language locale policy concern because it forces a specific locale behavior without offering the user a choice or explaining that the skill is intentionally region-specific.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The file consists entirely of Chinese-language labels and comments, indicating a fixed language/locale with no natural-language indication of user opt-in or an explicit region-specific justification. Under the policy rule for language or locale constraints, this can be considered a locale-specific default without documented choice.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This plain-text report uses Chinese throughout and does not indicate that the user can choose another language or that the output is intentionally restricted to a Chinese-only context. Under the policy rule for language or locale constraints, forcing a specific language without opt-in is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This plain-text report is entirely presented in Chinese and provides no indication that language selection is optional or constrained by a documented regional requirement. Under the policy rule for natural-language violations, a fixed locale without user opt-in can be a language/locale policy issue.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
The dependency specification uses a lower-bound only constraint (
requests>=2.31.0) rather than pinning to an exact version or constrained safe range, which makes builds non-reproducible and can allow an unexpected or later vulnerable release to be installed. In a tool that performs network requests to collect autocomplete data, dependency drift increases supply-chain and patch-management risk, though this file alone does not prove active exploitation.- Content
text requests>=2.31.0 # Excel 导出支持（可选） # pandas>=2.0.0
Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 86% confidence
- Finding
The manifest references
requestswithout pinning a specific reviewed version, while known advisories exist for some releases of that package. Because this skill likely makes outbound HTTP requests for keyword collection, using an affected version could expose confidentiality or request-handling weaknesses if the runtime resolves to a vulnerable release.- Content
Static analysis
No suspicious patterns detected.