Security audit

guaikei-rednote-radar

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Xiaohongshu public-data research integration, but users should understand that it sends targets to a third-party API and saves full results locally.

Install only if you are comfortable sending Xiaohongshu keywords, profile/note URLs, and retrieved public data to guaikei.com using your GUAIKEI_API_TOKEN. Treat saved logs as retained research data, especially for comment exports or competitor monitoring, and delete or protect the logs directory according to your data-handling rules.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (17)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 88% confidence
Finding: The public description frames the skill narrowly as an interaction-quality checker, but the file documents materially broader behavior: keyword search, note detail retrieval, comment scraping, creator post monitoring, local log writing, and third-party API transmission to guaikei.com. This mismatch can mislead users and reviewers about data collection scope and external data sharing, increasing the risk of unintended disclosure of queried URLs, research targets, and returned content.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The README materially broadens the skill from the manifest’s narrow purpose of assessing a Xiaohongshu creator’s real engagement quality into a general-purpose data-mining toolkit for competitor monitoring, trend prediction, content mining, and bulk collection. This scope expansion is dangerous because users and downstream agents may invoke capabilities outside the declared trust boundary, enabling unauthorized or policy-violating collection and analysis workflows under the guise of a narrower KOL-audit skill.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: Keyword trend discovery, latest-sort monitoring, and hot-topic detection are broader surveillance and market-intelligence functions not justified by the skill’s stated purpose of evaluating real likes/comments/favorites for KOL screening. This mismatch increases risk by enabling opportunistic scraping and monitoring tasks that users, agents, or reviewers would not expect from the declared engagement-audit use case.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: Acquiring comment details and performing sentiment-direction analysis exceeds merely measuring authentic engagement counts and moves into content-level collection and behavioral profiling. In context, this is more dangerous because the skill is presented as a limited KOL vetting tool, so collecting detailed comments can surprise users, expand personal-data exposure, and encourage broader monitoring than the declared purpose suggests.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The documentation materially broadens the skill from the manifest’s stated purpose of evaluating real engagement quality for a blogger or note into a general Xiaohongshu intelligence toolkit. That creates scope drift: an agent may invoke broad search, trend analysis, and competitor-monitoring behaviors users or platform owners would not reasonably infer from the declared skill purpose, increasing the chance of unauthorized collection or misuse.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: Platform-wide keyword search enables broad content discovery unrelated to assessing the authenticity of a specific blogger or note’s engagement. In an agent setting, this expands the skill into generalized collection and profiling of public content, which can be repurposed for surveillance, large-scale scraping, or marketing intelligence beyond the narrow stated use case.

Context-Inappropriate Capability

Medium

Confidence: 86% confidence
Finding: The competitor-analysis and trend-monitoring guidance explicitly promotes broader marketing-intelligence use cases than the manifest claims. That mismatch is dangerous because agents may use the skill for competitive monitoring and content intelligence under the cover of a narrower KOL engagement-evaluation tool, weakening transparency and governance.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The CLI creates and retrieves a comment task, then returns the full `commentTask` object in `results`, which likely includes raw comment content rather than only engagement-quality metrics promised by the skill description. This is a data-minimization and scope-expansion issue: users may invoke the skill expecting analytics, but the implementation exposes underlying content and increases privacy/compliance risk.

Context-Inappropriate Capability

Low

Confidence: 86% confidence
Finding: The code writes the full final output, including fetched comment-task results, to a local JSON file via `log.taskWrite(...)` without any clear necessity tied to the stated analytics-only purpose. Persisting potentially sensitive third-party content increases retention risk, expands the blast radius of host compromise, and may surprise users who expected transient CLI output only.

Description-Behavior Mismatch

Medium

Confidence: 87% confidence
Finding: The CLI persists fetched note-detail results to a local JSON file after completing the request, but this behavior is not clearly disclosed to the user in help text or prompts. Even if the source content is public, the saved output can include aggregated note/comment data and metadata that remain on disk longer than expected, creating unnecessary privacy and data-handling risk on shared or managed systems.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The CLI writes fetched results to a local file automatically, even though the primary function appears to be read-only analytics. This creates unintended data persistence, which can expose scraped profile/note data to other local users, backup systems, shared workspaces, or later compromise of the host, especially because users are not clearly warned that data will be retained.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The documentation instructs agents to pull note details, comments, and account posts without any warning about privacy, lawful basis, retention, or platform terms. Even when data is public, comments and profile-linked activity can contain personal information, and the lack of compliance guidance increases the risk of over-collection, secondary use, and policy violations.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: This code places the API token and target URL into a GET request query string, which is more dangerous than sending them in a request body because query parameters are commonly recorded in proxy logs, browser histories, upstream access logs, and monitoring systems. If exposed, the token could be reused against the backend API and the URL could reveal user investigation targets or customer data of interest.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The CLI silently writes fetched comment data to a local JSON log file after printing results, with no warning or consent flow in this file. Silent persistence creates an unexpected privacy and security exposure because comment content and request metadata may remain on disk long after execution.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: This code writes fetched detail data to a local file without any user-facing warning that results will be stored persistently. Unexpected persistence can expose collected data to other local users, backups, endpoint monitoring tools, or later misuse, especially when operators assume the tool only prints transient results to stdout.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: Writing fetched results to disk without explicit notice or consent is a security and privacy weakness because it changes transient command output into durable local data. In this skill context, the data concerns public social-media content, which lowers severity somewhat, but silent persistence still increases exposure and may violate user expectations or internal data-handling rules.

Missing User Warnings

Medium

Confidence: 79% confidence
Finding: The CLI persists full search results to a local JSON file automatically, without explicit user consent or a clear notice at execution time. In this skill context, search results may include potentially sensitive research targets, creator/account information, or business-intelligence queries; local persistence increases the risk of unintended disclosure through shared machines, insecure directories, backups, or log collection.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:16