guaikei-blogger

• Outcome: Pass
• Latest audit: Aug 9, 2026 · 3:29 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed Xiaohongshu public-data lookup tool that uses a third-party API and saves local result logs, with no evidence of hidden control, credential theft, private-data access, or destructive behavior.

Before installing, confirm you are comfortable sending Xiaohongshu keywords or links and your GUAIKEI_API_TOKEN to the guaikei.com API, and remember that results are saved locally under logs where collected content and target URLs may remain after the run.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The top-level skill metadata describes a narrow function—retrieving a creator's public posts from a profile URL—but the body of the skill routes to additional capabilities including keyword search, note detail/comment retrieval, and third-party API calls. This mismatch can mislead users, reviewers, or policy controls about what inputs are accepted and what data is sent externally, increasing the risk of unintended data exposure and overbroad use.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The README materially expands the skill’s described capabilities beyond the metadata, advertising keyword search, note-detail retrieval, comment analysis, trend monitoring, and KOL screening rather than only fetching a blogger’s public post list. This creates a scope-transparency problem: users and reviewers may grant permissions or trust based on a narrower stated purpose while the documentation signals broader scraping and analytics behavior.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The changelog describes materially broader capabilities than the declared skill purpose, including keyword search, note detail retrieval, comment sentiment analysis, hot-note mining, competitor analysis, KOL screening, and trend monitoring. This mismatch can mislead reviewers and users about the true operational scope, increasing the risk of undeclared data access, over-collection, or invocation of behaviors that were not security-reviewed.

Description-Behavior Mismatch

Medium

• Confidence: 84% confidence
• Finding: The CLI writes fetched results to a local file via log.taskWrite() after already printing JSON to stdout, but this persistence is not disclosed in the described read-only/structured-output behavior. Silent local storage can expose scraped content, metadata, and potentially sensitive URLs to other local users, backup systems, or downstream tooling that assumes no residual data is created.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The script persists the full output, including the requested profile URL and fetched blogger data, to a local JSON file after already printing the structured result to stdout. This creates undisclosed at-rest storage of potentially sensitive or regulated data and increases exposure through leftover files, broader filesystem access, or later collection by other processes.

Description-Behavior Mismatch

Medium

• Confidence: 82% confidence
• Finding: The CLI persists search results to a local JSON file even though the user-facing behavior emphasizes returning structured JSON. Silent local retention can expose potentially sensitive queries and returned content to other local users, backups, log collectors, or shared workspaces, especially in automated environments where operators may not expect disk artifacts.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: Automatically saving task results to logs/ can expose scraped content and user-supplied inputs such as profile URLs, note URLs, and search keywords to anyone with local access or to downstream backup/sync systems. Because this tool handles third-party content collection at scale, persistent logging increases the risk of unintended retention, data leakage, and compliance issues.

Missing User Warnings

Low

• Confidence: 90% confidence
• Finding: Writing detail results to a local JSON file without an explicit warning creates a transparency and data-handling risk. Even if the fetched content is public, stored output may include identifiers, timestamps, or query context that persist beyond the session and can be unintentionally disclosed or reused.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The script sends a user-provided Xiaohongshu profile URL together with an API token to external service functions without a clear runtime disclosure that the data leaves the local environment. In the context of a data-collection skill, this matters because users may assume the tool only transforms a public URL locally, while it actually transmits request metadata to a third-party backend.

Missing User Warnings

Low

• Confidence: 90% confidence
• Finding: The script stores result data and the requested profile URL in a local JSON file without making persistent storage obvious to the user. Even if the source data is public, silent retention can leak user activity, target lists, or collected datasets to other local users, backups, or later processes.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: Writing search results to a local JSON file without clear warning is a privacy/security weakness because users may supply sensitive keywords and receive data that becomes unexpectedly persisted on disk. In shared systems, CI runners, or managed endpoints, those files may be readable by other processes or retained long after the session ends.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.