Security audit

小红书数据洞察与竞品分析助手

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does what it advertises, but it automatically stores complete query results and tokenized URLs in a predictable temporary folder, so it needs review before use.

Use this only if you are comfortable sending Xiaohongshu keywords, links, and URL query parameters to guaikei.com and storing the returned data locally. Avoid running it on shared machines for sensitive research, strip unnecessary URL parameters where possible, and periodically delete the xiaohongshu-guaikei temp logs.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: src/utils/log.js:38
Finding: Automatic Storage of Sensitive Results in a Predictable Shared Temporary Directory
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (52)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description says this skill retrieves public Xiaohongshu data for multiple analysis use cases. The actual code chunk only implements reusable CLI argument parsing utilities (parseArgs, readValueAfterFlag, buildHelp). It does not connect to any external service, process Xiaohongshu links/keywords beyond generic argument handling, fetch public data, or analyze comments/sentiment. This is a materially different primary purpose, so the description does not accurately represent the supplied code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The declared description presents a Xiaohongshu public-data search and analysis capability. The actual code shown is a filesystem logging helper (taskWrite) that creates a temp-directory path and writes provided content to a local file after sanitizing the filename. This is materially different from the declared primary purpose, and the core described capabilities are absent from the supplied code. While logging could be a supporting detail in a larger skill, this chunk itself does not reflect the stated data-retrieval behavior and instead exposes an undeclared local file-write capability.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description presents a full Xiaohongshu data lookup and analysis capability. The supplied code chunk does not implement any such behavior; it merely reads package.json from the local filesystem and returns the package name. This is a materially different purpose from the declared functionality, so it should be flagged as a mismatch.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.
md
- "这条小红书笔记评论区在吐槽什么 → node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 200"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.
md
- "这条小红书笔记评论区在吐槽什么 → node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 200"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.
md
- "这条小红书笔记评论区在吐槽什么 → node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 200"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 275)May include surrounding context.
md
- "这条小红书笔记评论区在吐槽什么 → node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 200"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 278)May include surrounding context.
md
- "这条小红书笔记评论区在吐槽什么 → node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 200"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.
md
- "看这个小红书博主最近 30 条作品发什么 → node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 30"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 116)May include surrounding context.
md
- "看这个小红书博主最近 30 条作品发什么 → node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 30"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 281)May include surrounding context.
md
- "看这个小红书博主最近 30 条作品发什么 → node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 30"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 284)May include surrounding context.
md
- "看这个小红书博主最近 30 条作品发什么 → node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 30"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.
md
- "分析这篇小红书爆款笔记为什么火 → node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy'"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 114)May include surrounding context.
md
- "分析这篇小红书爆款笔记为什么火 → node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy'"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 127)May include surrounding context.
md
- "分析这篇小红书爆款笔记为什么火 → node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy'"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 130)May include surrounding context.
md
- "分析这篇小红书爆款笔记为什么火 → node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy'"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 272)May include surrounding context.
md
- "分析这篇小红书爆款笔记为什么火 → node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy'"

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 85% confidence
Finding: The skill declares access to an environment variable (GUAIKEI_API_TOKEN) but does not declare an explicit tool scope such as permissions or allowed-tools. That weakens least-privilege guarantees and makes it harder for a host agent or reviewer to understand and constrain what sensitive resources the skill may access.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill states that data flows to guaikei.com and requires users to provide Xiaohongshu links and keywords, but it does not prominently warn that user-supplied links, query parameters, and potentially embedded tokens in URLs are transmitted to a third-party service. This creates a privacy and data-handling risk because users may unknowingly send tracking parameters or sensitive business research targets to an external API.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The description and keywords are entirely in Chinese and specifically target the Xiaohongshu platform, which effectively constrains the skill's presentation to a single language/locale. In this manifest there is no indication that users can choose another language or that the locale restriction is explicitly justified as a region-specific tool.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README instructs users to interact with the agent using a Chinese natural-language example ('然后直接说人话：…') and the entire skill description is Chinese-only, with no indication that other languages are supported or that language choice is optional. This can violate language/locale policy when a skill effectively constrains user interaction to a specific language without opt-in.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/options.md (reported line 179)May include surrounding context.
md
| --------------- | ------------------------ | --------------------------------------------------------------------------------- | | `--url`, `-u` | 小红书博主主页链接，必填 | 建议使用主页链接或可解析的短链 | | `--limit`, `-l` | 返回作品数量上限 | 建议显式传入 `0-10000`；若为0，则获取该博主的互动数据（粉丝量、点赞量、收藏量等） | | `--help`, `-h` | 显示帮助信息 | 无 | ### 4.4 链接建议

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The document instructs users to retrieve comments, profile interaction metrics, and other public platform data, but it does not warn about privacy, terms-of-service, or downstream handling risks. In a skill that operationalizes large-scale collection of third-party social data, omission of compliance and data-handling safeguards can enable misuse such as unauthorized profiling, excessive scraping, or inappropriate retention and sharing of user-generated content.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The troubleshooting document is entirely written in Chinese and does not provide any language-selection option or note that the skill is intentionally limited to Chinese-speaking users. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The function sends a user-provided note URL and API token to an external API via postJson, but this file contains no confirmation prompt or user-facing disclosure about that transmission. Because this is a code file, outbound transmission of user or system data should have some visible warning unless clearly disclosed elsewhere.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.