Security audit

guaikei-rednote-explorer

Security checks across malware telemetry and agentic risk

Overview

This skill coherently fetches public Xiaohongshu/Rednote data through guaikei.com, with disclosed token/network use and automatic local result logs users should manage.

Install only if you are comfortable sending Xiaohongshu keywords or URLs, including any xsec_token query strings in those URLs, to guaikei.com using your GUAIKEI_API_TOKEN. Expect fetched public data to be saved locally in a logs directory after each run, and delete those files when they are no longer needed.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Context-Inappropriate Capability

Medium

Confidence: 87% confidence
Finding: The CLI writes the full search output to a local JSON file without obtaining explicit user consent at runtime or clearly documenting this behavior in the help text. Because search results may contain sensitive research targets, user queries, or collected third-party content, silent persistence increases the risk of local data leakage, over-retention, and accidental sharing.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The description says the skill should be used whenever a task involves getting Rednote data even if the user did not explicitly request collection or scraping, which broadens activation beyond clear user intent. This can cause unintended invocation of a third-party data-extraction workflow, leading to unnecessary data transfer, privacy/compliance issues, and actions the user did not knowingly authorize.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The CLI writes the full comment task output to a local JSON file without any explicit notice, consent, or control in this file. Because the skill is designed to collect large amounts of third-party social content, silent persistence increases privacy and data-retention risk, especially on shared hosts or multi-user environments where scraped content may remain accessible longer than intended.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: The script transmits the supplied note URL and comment limit to external task APIs, but the user-facing help shown in this file does not clearly disclose that their input will be sent off-box. In a data-collection skill, undisclosed outbound transmission can surprise users, expose sensitive query targets or tokens embedded in URLs, and create compliance/privacy issues.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The CLI persists fetched note details and comments to a local JSON file by default, which can retain scraped personal or sensitive content on disk after the command completes. In a data-collection skill focused on harvesting Xiaohongshu content at scale, silent persistence increases the chance of unintended disclosure through shared workstations, backups, logs, or later reuse of the file.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The CLI persists fetched Xiaohongshu results to a local JSON file automatically, but the user is not clearly warned that retrieved data will be written to disk. In a data-collection skill, this can expose scraped content, account identifiers, or URLs with tokens to other local users, backups, or logging systems, increasing privacy and data-handling risk.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The tool writes results to local storage even though the user-facing interface shown here does not clearly warn that execution creates a JSON artifact on disk. This can surprise users and expose harvested content and search terms to other local users, backup systems, or later processes that scan the filesystem.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:16