Security audit

guaikei-collector

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Xiaohongshu public-data collection tool that uses a Guaikei API token and saves results locally, with some privacy considerations users should understand.

Install only if you are comfortable sending Xiaohongshu keywords and URLs to Guaikei and keeping returned results in local log files. Avoid using private or sensitive links, and delete logs when the collected data is no longer needed.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Description-Behavior Mismatch

Low

Confidence: 81% confidence
Finding: The README claims the tool does not involve user privacy data, yet usage examples instruct users to pass full Xiaohongshu URLs containing xsec_token parameters. If those URLs are logged, shared, or sent to the external API, tokens may expose session-linked or access-scoped identifiers and create unintended leakage of sensitive request parameters.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The CLI persists collected note/comment data to a local JSON file after printing results, but this storage behavior is not disclosed in the visible skill description or this command's user-facing flow. Silent local persistence increases the chance of unintended retention, secondary exposure to other local users/processes, and accumulation of scraped data beyond the user's expectation.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The CLI persists scraped Xiaohongshu results to a local JSON file without making that storage behavior explicit to the user. Collected profile and note data may contain sensitive or regulated content, and silent disk persistence increases the risk of unintended retention, later disclosure, or reuse beyond the user's expectation.

Description-Behavior Mismatch

Low

Confidence: 87% confidence
Finding: The CLI persists collected search results to a local JSON file after printing them, which creates an additional data-retention channel beyond the apparent primary behavior of returning structured output. Even though this is not code execution or exfiltration, it can unintentionally store potentially sensitive research queries and scraped content on disk where other local users, processes, or backups may access it.

Context-Inappropriate Capability

Low

Confidence: 72% confidence
Finding: Including runtime metadata such as the Node version in normal output unnecessarily reveals environment details to whoever receives the JSON output. This increases fingerprinting value for attackers and is not required for the stated search/data-collection function.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: Automatically saving task results to logs can persist scraped content, source URLs, and embedded query parameters such as xsec_token without user awareness. This creates a local data exposure risk: sensitive URLs or collected datasets may remain on disk longer than intended and be accessible to other users, backup systems, or support processes.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The document instructs operators to submit keywords and Xiaohongshu note/profile URLs to external scripts and mentions an API token, but it never warns that these user-supplied inputs will be transmitted to a third-party service. This creates a privacy and consent gap: users may provide sensitive URLs, tracking parameters, or research terms without understanding that the data leaves the local environment and is processed externally.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The command writes returned result data to a local JSON file without an explicit warning or consent step in this file. Because the tool handles structured collected content and comments at scale, undisclosed persistence can create privacy, compliance, and workstation data-leakage risks if the host is shared or monitored.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The tool sends the user-supplied profile URL and an API token to an external service through createPostTask/getPostTask, but the CLI help and runtime messaging do not clearly warn that input data is being transmitted off-host. This can lead users to disclose targets, research subjects, or internal investigation context to a third party without informed consent.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The CLI writes full task results to a local JSON file by default without clearly warning the user. Silent persistence of scraped output creates a confidentiality and compliance risk because sensitive research data may remain on disk, be picked up by backups, or be accessible to other local users/processes.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The tool silently writes search results to a local file without an explicit user-facing disclosure in the main workflow. Because the skill collects third-party content and user-supplied keywords, undisclosed persistence raises privacy and compliance concerns and can leave a recoverable audit trail of research activity on disk.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.