Security audit

guaikei-rednote-acquisition

Security checks across malware telemetry and agentic risk

Overview

The skill is coherent with its stated purpose of fetching public Xiaohongshu data, but it sends requests through guaikei.com and automatically saves retrieved results locally.

Install only if you are comfortable sending Xiaohongshu search terms, note/profile URLs, and your GUAIKEI_API_TOKEN to guaikei.com. Use it for lawfully accessible public data, avoid private or login-only content, and review or delete the local logs directory when results may contain sensitive business research or personal comment data.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill requires access to the sensitive environment variable `GUAIKEI_API_TOKEN`, but the analysis indicates no explicit permission declaration accompanies that capability. This creates a governance and transparency gap: an orchestrator or reviewer may not realize the skill can access and transmit secrets to a third-party API, increasing the risk of unintended secret exposure or over-privileged execution.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The trigger text is intentionally broad: it activates not only for explicit data retrieval requests, but also whenever a user mentions Xiaohongshu/Rednote content and wants to 'understand' it. That can cause over-triggering, leading the agent to send user-provided keywords or URLs to an external service without sufficiently clear user intent, creating privacy, consent, and unnecessary data-exfiltration risks.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The README states that all task results are automatically saved to the `logs/` directory, but it does not clearly define what data is persisted, how long it is retained, or whether note URLs, comment content, keywords, or profile links may be stored. In a data-scraping skill focused on collecting public social-media data, unclear disk persistence increases the risk of accidental retention, over-collection, and unauthorized local exposure of potentially sensitive business intelligence or personal data.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The document instructs users how to collect public Xiaohongshu notes, comments, and creator content at scale, including limits up to 10,000 items, but it does not warn about privacy expectations, platform terms of service, or downstream data-use restrictions. This omission can encourage misuse of scraped social-media data for profiling, monitoring, or analysis without appropriate legal and policy review, increasing compliance and privacy risk.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The CLI writes the full fetched note detail payload to a local JSON file after successful execution, and this can include scraped content and comments that may contain personal or sensitive data. Because the write happens automatically with no opt-in, warning, retention control, or masking visible in this file, it increases the risk of unintended local data persistence, later disclosure to other users/processes, or accidental inclusion in backups and logs.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The CLI writes the full search output to a local JSON file using a filename derived from user-controlled content (`keyword`) without any user opt-in or warning. In this skill’s context, search results and keywords may reveal user interests or collected third-party data, so persisting them locally increases privacy and data-retention risk, especially on shared systems or agent hosts.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:16