Security audit

guaikei-comment

Security checks across malware telemetry and agentic risk

Overview

This skill is not clearly malicious, but its actual Xiaohongshu search, comment scraping, profile-post monitoring, third-party API use, and automatic local result logging are broader than its comment-focused title and summary suggest.

Install only if you intentionally want a broader Xiaohongshu public-data collection tool, not just a note-comment fetcher. Expect keyword searches, note detail/comment retrieval, blogger post listing, third-party API transmission via GUAIKEI_API_TOKEN, and automatic local JSON result files under logs/.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (19)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill metadata presents a narrow comment-collection function, but the documentation expands behavior to keyword search, profile monitoring, and local result persistence. This mismatch is dangerous because users, reviewers, or policy gates may approve the skill under a less sensitive scope than it actually operates with, leading to unexpected data collection and storage.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The top-level manifest describes a comment-scraping skill, while the body documents a broader Xiaohongshu data-mining suite. Security and compliance decisions often rely on manifest summaries, so this discrepancy can cause under-review of collection scope, third-party API use, and downstream handling of scraped user data.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The usage examples advertise commands for search, note detail retrieval, and creator monitoring that go beyond the manifest's stated comment-only scope. This creates a practical path for misuse because operators may execute broader collection actions under a misleadingly narrow approval context.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The capability boundary section explicitly broadens the skill into three distinct Xiaohongshu data-mining functions, contradicting the manifest's narrower presentation. In context, this makes the issue more serious because the skill collects public user-generated content and profile activity through a third-party API, so transparency about scope is essential for informed consent, review, and policy enforcement.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The package metadata advertises a much broader Xiaohongshu analytics and marketing capability set than the declared skill purpose of collecting public comments from a note URL. This scope mismatch is dangerous because it can mislead reviewers and users about what the package is intended to do, hide undeclared collection or processing behavior, and weaken trust boundaries during installation and approval.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The declared entrypoints expose search, detail, and post operations that go beyond the manifest's stated comment-harvesting functionality. In this skill context, undeclared operational surface is risky because it may enable broader scraping or interaction workflows than users and reviewers expect, increasing the chance of unauthorized data access or policy-violating behavior.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The README materially expands the skill from simple Xiaohongshu comment collection into a broader data-mining and competitive-intelligence suite, including keyword search, competitor monitoring, KOL screening, and trend prediction. This mismatch can mislead users, reviewers, or automated systems about the true scope and data-handling behavior of the skill, increasing the risk of unauthorized use cases or hidden functionality escaping scrutiny.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The changelog advertises capabilities far beyond the declared skill purpose, including keyword search, user monitoring, note-detail scraping, sentiment analysis, commercial intelligence, and broad Xiaohongshu data collection. This scope drift is dangerous because it can conceal undeclared functionality, weaken user consent and review expectations, and indicate the skill may be used for broader scraping or surveillance than the manifest suggests.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The documentation materially expands the skill from comment collection on a provided note link into three separate Xiaohongshu capabilities: keyword search, note detail/comment extraction, and creator post monitoring. This scope drift is dangerous because downstream agents may rely on the docs rather than the manifest and invoke broader data collection behavior than the user or platform review process expected, increasing the risk of unauthorized scraping or misuse.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The keyword-search section introduces a discovery/scraping capability unrelated to the stated purpose of collecting comments from a user-provided note URL. This broadens the operational surface from a bounded retrieval task to open-ended content enumeration, which can enable large-scale collection of public content and cause agents to perform actions outside the user's understood consent and the skill's reviewed purpose.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The creator post listing/account monitoring section adds account-level collection and monitoring behavior beyond comment retrieval for a single supplied note. In context, this is more dangerous because it enables longitudinal tracking of a creator's activity, expanding both privacy and compliance risk relative to the narrowly described comment-analysis use case.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The implementation in this file creates and retrieves published-post tasks for blogger URLs, while the skill manifest claims it collects public comments from note URLs. This mismatch is dangerous because users and downstream systems may provide note links and expect comment-only collection, but the code targets a different data domain, creating a deceptive capability gap that can cause unauthorized or broader-than-expected data collection.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The module comments and function documentation explicitly describe blogger-detail and published-post behavior that contradict the stated purpose of comment collection. In a security-sensitive agent ecosystem, misleading documentation increases the likelihood of unsafe delegation, operator misunderstanding, and misuse of a skill against unintended targets or data types.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The implementation performs Xiaohongshu note search by keyword rather than the manifest-declared behavior of collecting comments from a provided note URL. This capability mismatch is dangerous because users and downstream systems may grant or invoke the skill under false assumptions, enabling unintended data collection and broader scraping than the declared scope.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The module comments and function documentation explicitly describe note-search behavior that contradicts the advertised purpose of comment harvesting from a note link. Misleading documentation increases the risk that reviewers miss undeclared scraping behavior and that operators expose a wider data-collection surface than intended.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The CLI persists the full fetched result set, including public comments and commenter metadata, to a local JSON file without any opt-in or disclosure in the stated behavior. This creates an unnecessary secondary copy of potentially sensitive scraped data on disk, increasing exposure through local compromise, accidental sharing, backups, or multi-user system access.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The CLI schema and help text clearly operate on a user profile URL and a post-count limit, which conflicts with the manifest’s stated purpose of collecting comments from a note URL. This capability mismatch is dangerous because users or orchestrators may grant the skill access expecting comment-only collection, while it instead enumerates a creator’s profile posts and broadens data collection scope beyond the declared intent.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The returned payload is labeled and handled as a post task result rather than structured comment JSON, again contradicting the advertised skill behavior. This semantic mismatch can mislead downstream agents into processing unexpected scraped profile/post data, increasing the risk of over-collection, privacy issues, or unsafe automation decisions based on falsely described output.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The skill persists scraped results to a local file even though its stated purpose is to return structured JSON. Undisclosed local persistence increases exposure of potentially sensitive scraped data, creates residual artifacts on disk, and can violate least-privilege expectations in agent environments where users only consented to transient processing.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.