Security audit

guaikei-detail

Security checks across malware telemetry and agentic risk

Overview

The skill does not show malicious behavior, but it needs review because its headline describes single-note lookup while the package also supports broad search, profile-post collection, third-party API use, and automatic local result storage.

Review this before installing if you expected only single-note lookup. Use it only for public Xiaohongshu data, confirm you are comfortable sending keywords, URLs, limits, and the GUAIKEI_API_TOKEN to Guaikei's API, and check or clean the local logs directory because fetched results may persist on disk.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (22)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 84% confidence
Finding: The public description says the skill is for single-note detail lookup, but the body documents materially broader capabilities: keyword search, creator monitoring, comment retrieval, and local log writing. This mismatch can mislead users and reviewers about the data collection scope and retention behavior, increasing the risk of unintended data access, over-collection, and unanticipated third-party/API data disclosure.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The package metadata advertises a much broader analytics and growth-marketing capability set than the skill manifest, which claims to only retrieve details for a single Xiaohongshu note. This scope mismatch is dangerous because it can mislead reviewers and operators about what the package is intended to do, increasing the chance that hidden or later-enabled functionality is trusted under a narrower permission expectation.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The declared scripts expose search and post entrypoints in addition to detail retrieval, directly contradicting the stated skill purpose of note-detail lookup. In a security review context, undisclosed extra execution paths are risky because they may enable data collection or content publishing beyond expected behavior, expanding the attack surface and privilege scope.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The README describes a much broader Xiaohongshu data-mining and competitive-intelligence suite than the skill metadata, which only presents single-note detail retrieval. This scope mismatch is dangerous because users and downstream agents may grant broader trust, permissions, or operational use than intended, increasing the risk of unauthorized scraping, policy violations, or misuse beyond the declared capability.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The documentation advertises batch operation and collection of up to 10,000 records, which exceeds the stated single-note detail use case. In this context, the discrepancy increases abuse potential by normalizing large-scale scraping behavior and misleading users about the operational scope and review status of the skill.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The README includes keyword search and account-monitoring commands that are not reflected in the manifest description for a note-detail query skill. This is risky because it exposes materially different collection workflows—search-based discovery and profile monitoring—that can enable surveillance or competitive scraping under the guise of a narrower tool.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The changelog claims the skill supports broader capabilities such as keyword search, comment sentiment analysis, user-work monitoring, hot-note mining, competitor analysis, KOL screening, and trend monitoring, while the manifest describes only single-note detail lookup. This scope mismatch is dangerous because users, reviewers, or downstream agents may rely on undocumented or hidden functionality, reducing transparency and potentially masking expanded data collection or scraping behavior beyond the declared purpose.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The documentation states the skill supports three separate capabilities, while the declared metadata says it is only for single-note detail retrieval. This scope drift is dangerous because an agent may invoke broader scraping behaviors than the user or policy expects, weakening least-privilege boundaries and making oversight harder.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The task-routing table instructs the agent to choose between keyword search, note detail, and blogger-post collection, which exceeds the manifest's single-note-detail description. This can cause unauthorized or unexpected data collection paths to be triggered under a misleadingly narrow skill identity.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The keyword-search section documents a full discovery capability outside the stated purpose of analyzing a single note URL. Search expands collection from one user-supplied artifact to potentially large-scale content harvesting, increasing compliance, misuse, and review-scope risk.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The blogger-post retrieval section adds account-level monitoring capability, which is materially broader than single-note detail lookup. This creates a risk of silent expansion into recurring profile surveillance or competitor tracking without corresponding disclosure or controls.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The skill metadata says it retrieves details for a single Xiaohongshu note from a provided note link, but this code creates keyword-based search tasks that can return many notes. That scope expansion enables content discovery and collection beyond the declared purpose, which increases privacy, compliance, and misuse risk because users and platform operators would reasonably expect single-item lookup rather than broad search capability.

Description-Behavior Mismatch

Low

Confidence: 87% confidence
Finding: The code assembles direct URLs for multiple notes and user profile pages from search results, which reinforces browsing and enumeration behavior not described in the skill description. While not inherently code-execution dangerous, it facilitates navigation to additional content and profiles, expanding data exposure and making the undeclared search capability more operationally useful.

Description-Behavior Mismatch

Medium

Confidence: 87% confidence
Finding: The tool writes fetched note details and associated results to a local JSON file by default, but this persistence is not disclosed in the skill description or clearly surfaced to the user at execution time. Persisting potentially sensitive scraped content and metadata can create unintended local data retention, exposure to other local users/processes, and compliance/privacy issues.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The CLI schema and surrounding logic clearly target creator profile URLs and fetch multiple homepage posts, which materially conflicts with the manifest claim that the skill retrieves details for a single Xiaohongshu note. This kind of scope mismatch is dangerous because it can cause over-collection of data, violate least-privilege expectations, and mislead users or downstream agents into sending broader targets than intended.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The help text, flag descriptions, and examples repeatedly describe a creator profile workflow, contradicting the advertised note-detail purpose. This inconsistency increases the risk of operator confusion, accidental data collection beyond user intent, and unsafe automation decisions by systems that trust the manifest more than the code.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The README states that all task results are automatically saved to the logs/ directory, but it does not warn that queried links, keywords, returned note content, or analysis outputs may be stored locally. This creates a data-handling risk because sensitive research targets, proprietary analysis, or regulated content may persist on disk unexpectedly and be exposed through local access, backups, or log sharing.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The documentation encourages collection of comment data and analysis of public content but does not mention privacy expectations, platform terms, retention limits, or downstream use restrictions. That omission increases the chance the agent will collect and process personal or sensitive user-generated content without adequate safeguards or user warning.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: Writing detail results to disk without explicit warning or consent can surprise users and leave behind structured records of fetched content, URLs, timestamps, and other metadata. In shared or monitored environments, these files may be readable by other users, indexed by backup systems, or retained longer than intended.

Missing User Warnings

Medium

Confidence: 78% confidence
Finding: The command sends the user-provided Xiaohongshu URL and an API token to remote service functions, but the user-facing flow in this file does not clearly disclose that third-party transmission occurs. This can create privacy and trust issues because users may assume a local-only lookup while their input and access token are used for external API requests.

Missing User Warnings

Medium

Confidence: 82% confidence
Finding: The code transmits the user-supplied URL together with an API token to external post task endpoints, but the CLI does not clearly disclose that this data is being sent to a third-party service. In a skill ecosystem, that lack of transparency can lead users or orchestrators to expose URLs, identifiers, or tokens without informed consent, especially when the skill's stated purpose is already misleading.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: The CLI writes full search results to a local JSON file without clearly disclosing this behavior before execution. Because results may contain user queries, author metadata, and engagement data, silent persistence can create privacy and data-handling risks on shared systems or in automated environments where local artifacts are collected or exposed.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.