Security audit

guaikei-rednote-ops

Security checks across malware telemetry and agentic risk

Overview

The skill is a disclosed Xiaohongshu data tool, but its top-level description says comment-only while the docs and code expose broader search, note-detail, and creator-post collection.

Install only if you intend to use a broad Xiaohongshu public-data collection tool, not just a comment fetcher. Expect keywords, note/profile URLs, and API tokens to be sent to guaikei.com, and expect returned results to be saved locally under logs. Use it only for public data and review platform/legal constraints before bulk collection.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (22)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The manifest and top-level description position the skill as comment-only, but the body documents broader behaviors: keyword search, note detail retrieval including正文, creator profile/post monitoring, URL construction, and local logging. This mismatch is dangerous because callers, policy engines, or users may grant trust and supply data under a narrower expectation, while the skill can collect and process a materially larger dataset than advertised, increasing privacy, compliance, and data-exfiltration risk.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The manifest frames the skill as only retrieving comments for a single note, while the documented behavior includes search, note details, and creator monitoring. Security tooling and human reviewers often rely on manifest summaries for routing and approval, so this understatement can bypass scrutiny and cause over-collection of public but still sensitive behavioral/profile data.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The examples and routing instructions actively direct use of non-comment scripts despite the manifest advertising a comment-only skill. This is dangerous because examples are operational guidance; they can cause automated agents or users to invoke broader data-collection paths than intended, undermining transparency and least-privilege expectations.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: The README materially conflicts with the declared skill scope by presenting a broad Xiaohongshu data-mining and operations toolkit, including trend prediction, competitor monitoring, KOL screening, and bulk data extraction. This kind of scope inflation is dangerous because users, reviewers, or downstream agents may grant the skill broader permissions or invoke it for functions outside its approved purpose, undermining least-privilege and trust boundaries.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The README explicitly documents note-detail retrieval even though the manifest says the skill only fetches comments and not note正文. This mismatch can cause the skill to be used or trusted for unauthorized content access paths, and may conceal overbroad implementation behavior relative to the declared contract.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The README advertises keyword search and competitor account monitoring beyond comment analysis, indicating the documented behavior exceeds the approved use case. In skill ecosystems, such mismatches increase the risk of privilege creep, operator misuse, and accidental processing of data types that were not reviewed under the declared purpose.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The changelog documents broader capabilities such as keyword search, note detail retrieval, creator monitoring, and sentiment analysis, while the current skill metadata claims a narrower scope limited to comment retrieval only. This mismatch can cause downstream agents or users to invoke functionality outside the declared boundary, increasing the risk of over-collection, privacy-impacting data access, or unauthorized processing paths if legacy capabilities still exist.

Intent-Code Divergence

Low

Confidence: 80% confidence
Finding: The changelog states the skill supports note-detail retrieval and comment sentiment analysis, which conflicts with the present declaration that it only fetches comments and not note正文. Even if only documentary, this inconsistency can mislead orchestration systems into requesting broader data access or trusting outputs derived from unsupported or legacy functions.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The implementation retrieves full note detail metadata in addition to comments, which exceeds the declared skill scope of comment-only analysis. This creates an unnecessary data-access expansion that can expose extra user/content fields and undermines least-privilege and user expectations about what the skill collects.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The file comments and function docstrings explicitly describe a note-detail-and-comments module, contradicting the manifest's claim that the skill only fetches comments. This mismatch is dangerous because it signals the code was designed for broader collection than disclosed, increasing the risk of overcollection, misuse, and operator misunderstanding during deployment or review.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: This code implements published-post retrieval for a blogger, which materially contradicts the skill’s declared purpose of collecting only note comments, commenter information, and interaction data. In an agent setting, this kind of scope mismatch is dangerous because it can cause the system to access different data than the user authorized or expected, enabling silent over-collection and deceptive behavior.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The result retrieval path returns published note data (`res.data` from a post-info API), not comment content or audience-feedback data promised by the skill description. That mismatch can mislead downstream agents and users into believing they are analyzing comment sentiment while actually processing unrelated creator content, which is a serious integrity and scope-control issue.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The inline documentation explicitly states blogger-detail and published-note functionality, directly contradicting the manifest’s comment-only purpose. Misleading documentation in a skill is a security-relevant issue because it normalizes the broader behavior, reduces reviewer suspicion, and increases the chance that unsafe data access is shipped or approved unnoticed.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The implementation performs keyword-based note search and returns note/user profile URLs, which contradicts the skill’s declared comment-only purpose. This creates a scope-expansion/data-minimization issue: consumers invoking the skill for comment analysis may unknowingly collect broader content and user-profile data than intended, increasing privacy, compliance, and misuse risk.

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The module comments and function documentation explicitly describe note search behavior, reinforcing a mismatch between advertised behavior and actual capability. Misleading documentation can cause downstream systems or users to over-trust the skill’s data boundaries, leading to unauthorized collection or processing beyond the stated comment-analysis use case.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The implementation returns `detailTask` as the full result set for a command described as comment-only, creating a scope mismatch between the skill manifest and actual data access. This can expose note body or other metadata beyond the user's expected consent boundary, which is a data-minimization and over-collection issue in an agent context.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The help text and user-facing documentation explicitly describe the command as fetching note details, which conflicts with the declared skill purpose of comment-only extraction. In an agent environment, misleading interface text can cause operators and downstream systems to invoke a broader data-access path than intended, weakening informed use and policy enforcement.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The CLI schema and help text show this tool accepts a blogger profile URL and a limit for homepage notes, which directly contradicts the manifest claiming the skill retrieves comments for a single note. This kind of capability mismatch is dangerous because downstream agents or users may authorize the skill expecting narrow comment-only access, while it actually collects broader profile/post data, violating least privilege and enabling unintended data collection.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The runtime logic validates profile URLs, normalizes them, and creates a 'post' task for homepage note collection rather than operating on a single note's comment area. In an agent setting, this is a security-relevant scope violation: the skill can access and return data outside the user's requested object, increasing privacy, consent, and policy risks.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The inline descriptions and generated help explicitly say the tool handles blogger links and homepage note counts, contradicting the manifest's 'comment-only' purpose. Misleading documentation is dangerous in agent ecosystems because tool selection and user consent often depend on metadata and help text; this discrepancy can cause overcollection even without any obvious exploit payload.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: This file implements a generic keyword-based Xiaohongshu search CLI, which materially exceeds the skill’s declared purpose of retrieving comments for a specific note. In an agent setting, this kind of scope mismatch is dangerous because it gives the skill a broad discovery capability over platform content, enabling collection of unrelated posts and expanding data access beyond what users and reviewers would reasonably expect.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The argument schema exposes broad search parameters such as keyword, type, sort, time, and large result limits, creating a platform-wide discovery surface unrelated to comment analysis on a single note. In context, this increases the chance of unauthorized scraping, user surprise, and policy bypass because the skill can enumerate content rather than operate narrowly on a user-supplied target.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:16