T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/request.js:41- Finding
API Token Exposed in HTTP Query Strings
- Content
View full analysis
- Remediation
View remediation
Security audit
小红书内容分析 - 获取小红书内容表现数据
Security checks for vulnerabilities and agentic risk
Overview
This Xiaohongshu analytics skill is mostly coherent, but it sends user inputs and an API token to a third-party service, handles that token insecurely, accepts bypassable URLs, and saves results locally.
Review this skill before installing. Only use it if you are comfortable sending Xiaohongshu search terms, note URLs, and your Guaikei API token to the Guaikei service, and with result files being saved locally. Avoid sensitive or private research topics, do not submit non-Xiaohongshu URLs, and rotate the API token if it has already been used with this version.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
src/validate/url.js:6- Finding
Bypassable Xiaohongshu URL Allowlist
- Content
View full analysis
- Remediation
View remediation
0; } if (parsed.hostname === "xhslink.com") { return parsed.pathname.startsWith("/m/"); } return false; } ``` 2. Require exact hostname equality rather than suffix or substring matching. 3. Validate pathname and query parameters independently after parsing. 4. Do not transform HTTP input into HTTPS with string replacement; reject non-HTTPS input or normalize it through parsed URL fields. 5. Have the remote API independently enforce the same destination allowlist. 6. If short links are followed, validate every redirect destination and allow only approved Xiaohongshu hosts. 7. Block loopback, private, link-local, and metadata-service addresses after DNS resolution in any component that performs server-side URL fetching. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (22)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The documentation describes a Xiaohongshu analysis skill, but it instructs users to obtain a third-party API token via WeChat and static analysis notes reference a non-Xiaohongshu external resource. This mismatch is dangerous because it obscures where data is actually sent and processed, preventing informed consent and making covert exfiltration or policy-violating collection harder to detect.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md command: "node src/xiaohongshu/detail-cli.js -u 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy'"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md command: "node src/xiaohongshu/detail-cli.js -u 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy'"
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 85% confidence
- Finding
The skill requires an environment variable token (
GUAIKEI_API_TOKEN) but does not declare any explicit tool scope or permissions boundary. This weakens reviewability and user awareness because the skill can access secrets at runtime without a clear manifest-level disclosure.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The activation guidance is broad enough to trigger on generic research requests, which can cause the skill to run in contexts where users did not specifically intend external platform analysis. That increases the risk of unnecessary transmission of user prompts, keywords, or URLs to third-party services.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The documentation advertises competitor monitoring and real-time hot-search retrieval beyond the clearly declared scope. Overstated capabilities are risky because users may provide broader inputs or expect actions the skill was not reviewed for, increasing the chance of improper data handling or unauthorized scraping behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill requires an API token and likely sends search keywords and note URLs to an external service, but the documentation lacks a clear privacy and data-transmission warning. Users may unknowingly disclose sensitive research topics, URLs, or operational metadata to a third party without informed consent.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The warning and recovery messages are hard-coded in Chinese, which imposes a specific language on users. There is no indication that the skill is region-specific or that users can opt into their preferred language, so this conflicts with the language/locale policy criteria.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The hardcoded error string is entirely in Chinese and directs the user to contact a specific WeChat number, with no indication that language is selectable or region-specific. This can violate language/locale policy because it imposes a specific language on all users without opt-in or documented justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This JavaScript file contains natural-language comments and error messages exclusively in Chinese, such as the function comment and multiple validation errors. Because the skill does not indicate that it is intentionally limited to Chinese-speaking users or offer any language/locale opt-in, it creates a language-policy concern under the locale-choice rule.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The script reads
GUAIKEI_API_TOKENand sends the search keyword and options throughsearch.createSearchTask(...)andsearch.getSearchTask(...), which are network operations transmitting user and system-associated data. Although the help mentions that the token must be configured, it does not warn users that their query data will be sent to an external service.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The CLI writes full search output, including the user’s keyword and returned content, to a local JSON file automatically without explicit notice or opt-in. This can create unintended data retention on disk, exposing potentially sensitive research terms or collected platform data to other local users, backups, or later exfiltration if the host is shared or compromised.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
All user-facing natural-language instructions in the manifest and README content are presented in Chinese, and the file does not indicate that language selection is optional or user-configurable. This can constitute a language/locale policy issue when a skill implicitly forces one language for all users.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill is consistently documented as a Xiaohongshu/RedNote analytics tool, but L117 says '仅抓取抖音公开数据', which refers to a different platform. This is an active contradiction in the documentation about the target service and could mislead users about the skill’s actual intent.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
This code sends a caller-supplied API token and note URL to a remote endpoint via postJson, but the function only has technical docstrings and retry error logs. There is no user-facing warning, confirmation, or explicit disclosure here that these inputs will be transmitted off-box.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The getDetailTask function performs a network request containing the API token and URL, which can expose user or system data to an external service. While retry errors are logged, the code does not include any warning or explanatory comment to disclose this data transmission behavior.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
This JavaScript file uses Chinese-only natural-language documentation and error/logging strings, indicating the skill is tailored to a single language without offering any language choice or documenting a justified locale restriction. The policy explicitly calls for flagging language or locale constraints when they are forced without user opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The code emits fixed Chinese-language status and error messages in string literals, which imposes a specific language on users without offering a choice or documenting a justified locale restriction. This matches the policy category for language or locale constraints lacking user opt-in.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This code sends JSON data over HTTPS via postJson, but there is no confirmation prompt, user-facing log, or inline warning indicating that provided data will be transmitted to an external service. For a reusable request utility, this network transmission is safety-relevant and not disclosed here.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The thrown error string is hard-coded in Chinese ("重试${maxAttempts}次后失败"). This imposes a specific language in user-visible output without any indication of locale selection, opt-in, or region-specific justification, which matches the language policy violation criteria.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This code contains user-facing Chinese text in the module comment, banner output, and localized logging context, but provides no indication that the language choice is optional or tied to a justified region-specific requirement. The policy explicitly calls for flagging language or locale constraints when the skill forces a specific language without user opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The natural-language strings in comments and user-facing error messages are exclusively in Chinese, including input guidance and validation feedback. This creates a locale policy concern because the skill appears to require a specific language for understanding outputs without offering a language choice or documenting a justified region-specific constraint.
- Content
Static analysis
No suspicious patterns detected.