Security audit

guaikei-rednote-growth

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed public Xiaohongshu data tool, but it has broader collection and automatic local saving than its headline description suggests.

Install only if you are comfortable sending Xiaohongshu keywords, note URLs, creator URLs, and requested limits to guaikei.com, and with full returned results being saved locally under logs/. Use explicit, narrow limits, avoid collecting unnecessary comments or account histories, and treat GUAIKEI_API_TOKEN as a secret.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (28)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 89% confidence
Finding: The published description narrowly frames the skill as recent keyword-based trend discovery, but the documentation exposes broader data collection functions including note details, comments, creator monitoring, and local logging. This mismatch can cause users or orchestrators to invoke the skill under a false trust boundary, leading to unintended data collection, storage, or external transmission to the third-party API.

Description-Behavior Mismatch

Medium

Confidence: 86% confidence
Finding: The manifest text limits the skill to recent keyword trend discovery, while the body advertises detail retrieval, comment extraction, and creator monitoring. That discrepancy weakens informed consent and safe routing because systems may grant or trigger the skill for a narrower use case than it actually implements.

Intent-Code Divergence

Medium

Confidence: 81% confidence
Finding: The documentation claims a narrow, trend-focused, non-historical purpose, but later sections market broader analytics and monitoring. This can bypass user expectations and policy controls that rely on the manifest description, increasing the chance of over-collection or misuse of public-profile and comment data.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The README presents a much broader Xiaohongshu data-mining suite than the declared skill purpose, including competitor monitoring, KOL screening, comment analysis, and large-scale data collection. This mismatch can mislead users and reviewers about the actual operational scope, increasing the risk of over-collection, misuse, and accidental invocation of capabilities outside the approved intent.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The documentation mixes the narrow trend-monitoring use case with commands for note details, account monitoring, and comment extraction, which materially expands the apparent behavior of the skill. In a security review context, this kind of scope drift undermines least-privilege expectations and can hide data collection features users did not intend to use.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The documentation expands the skill from the manifest-declared purpose of recent keyword trend lookup into four broader collection capabilities, including note details, creator monitoring, and comment retrieval. This creates a scope mismatch that can cause an agent or user to invoke data-access behaviors they did not consent to or expect, increasing the chance of over-collection and policy bypass.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The keyword-search section claims popularity sorting and time-range analysis beyond the stated skill purpose of fetching recent notes sorted by latest. That mismatch can mislead orchestrators into using the skill for unsupported or broader surveillance-style analysis, resulting in unintended data access or inaccurate trust assumptions about what the skill does.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: This section documents note-detail and comment-analysis features that are materially broader than the manifest's keyword-trend scope. Accessing note content and comments can expose user-generated content and expand collection from trend discovery into targeted content inspection, which materially raises privacy and compliance risk.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The creator post monitoring capability adds account-level tracking functionality outside the declared keyword-trend use case. Monitoring a creator's publication history is more sensitive than generic trend lookup because it enables persistent profiling and competitive surveillance beyond the user's likely expectation from the manifest.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: Standalone comment harvesting goes beyond recent keyword-note discovery and enables bulk extraction of user discussion data. Even if the content is public, this broadens the skill into collection and analysis of third-party user speech, which increases privacy, moderation, and downstream misuse risks.

Context-Inappropriate Capability

Low

Confidence: 84% confidence
Finding: The documentation instructs users to configure an API token for capabilities that exceed the manifest's justified scope. This is risky because it normalizes credential provisioning for broader actions than users may have authorized, increasing the blast radius if the skill is mis-scoped or later abused.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: This module adds functionality to create and retrieve Xiaohongshu comment tasks, which exceeds the stated skill scope of monitoring recent note trends. Scope expansion is dangerous because it enables collection of additional user-generated data not disclosed by the manifest, increasing privacy, compliance, and misuse risk if the agent is granted trust based on a narrower description.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The code implements blogger-profile post retrieval by URL, while the skill manifest claims the skill retrieves recent notes under a keyword for trend monitoring. This capability mismatch is dangerous because it grants access to a different data collection path than users and reviewers would expect, enabling undisclosed scraping of specific accounts and undermining consent, review, and least-privilege assumptions.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: This CLI fetches note comments, which is materially broader than the declared skill purpose of recent keyword-based trend discovery. Scope expansion matters because comments can contain user-generated personal or sensitive content, increasing privacy and data-handling risk beyond what a user would reasonably expect from a trend-monitoring skill.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The file implements a note-detail retrieval workflow, including comments, even though the skill metadata says the skill is for recent keyword-sorted hotspot/trend discovery rather than per-note deep extraction. This scope expansion matters because it enables collection of richer content tied to individual posts, increasing data access beyond what users and reviewers would reasonably expect from the declared skill purpose.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The --limit option allows extraction of up to 10,000 comments for a single note, which is disproportionate to a trend-monitoring use case. Bulk comment collection can expose large volumes of user-generated content and metadata, creating unnecessary privacy, compliance, and abuse risk if the skill is used for scraping rather than lightweight trend inspection.

Context-Inappropriate Capability

Low

Confidence: 88% confidence
Finding: The skill writes retrieved note details and comments to a local JSON file even though the skill appears to be a read-style lookup tool. Persisting scraped content locally increases exposure through accidental retention, unauthorized access by other local users/processes, and mismatch with user expectations about transient processing.

Description-Behavior Mismatch

Low

Confidence: 84% confidence
Finding: The CLI writes full search output to a local JSON file, including user-supplied keywords and returned results, without clear disclosure or consent. If the keyword or results contain sensitive business topics, personal data, or regulated content, this creates unnecessary local data retention and possible exposure to other local users/processes.

Context-Inappropriate Capability

Low

Confidence: 82% confidence
Finding: Persistent local logging is not necessary to perform a one-shot trend lookup and increases the attack surface by leaving data at rest. In the context of a trend-monitoring skill, broad result logging is more dangerous because operators may search sensitive brands, incidents, or campaign terms and unknowingly create a local audit trail.

Vague Triggers

Medium

Confidence: 78% confidence
Finding: The activation language is broad enough that the skill may trigger on loosely related requests about 'what's happening recently' on Rednote, even when the user did not clearly ask for external data retrieval. Over-broad triggering raises the risk of unnecessary third-party API calls and unintended disclosure of user-provided keywords or URLs.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The package description is marketing-heavy and broadly frames the tool as a general-purpose growth, competitor monitoring, KOL filtering, and profiling solution, without clearly constraining when the skill should be invoked. In an agent setting, overly broad descriptions can cause over-invocation on loosely related requests, leading to unnecessary data access, unintended scraping behavior, or use outside the narrow 'recent Rednote trend monitoring' purpose stated in the skill metadata.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The README states that all task results are automatically saved under logs/, but it does not clearly warn that searched keywords, URLs, and collected platform data may be persisted locally. This creates a privacy and operational security risk because sensitive research targets, monitoring subjects, or campaign topics could remain on disk unintentionally and be exposed to other local users, backups, or log shipping systems.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The documentation describes retrieving note content and comment data without any explicit warning about privacy, retention, or appropriate handling of user-generated content. This omission is dangerous because operators may collect or analyze third-party data without understanding the sensitivity, legal constraints, or need for minimization.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The setup section requires an API token but does not warn that the credential is sensitive or provide safe-handling guidance. This can lead users to expose the token in logs, shell history, screenshots, or shared environments, enabling unauthorized use of the associated API access.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The code writes fetched comment results to a local JSON file automatically, without clear user disclosure, retention limits, or redaction. Because comments may contain personal data or sensitive user content, silent persistence increases the chance of unintended local exposure, later exfiltration, or mishandling.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:16