Security audit

guaikei-rednote-scraper

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent public Xiaohongshu data-scraping integration, with disclosed API-token use and local result archiving, but users should be aware it saves fetched data to disk.

Install only if you are comfortable sending Xiaohongshu keywords/links and your GUAIKEI_API_TOKEN to guaikei.com. Expect successful runs to leave JSON result files under the skill's logs/ directory; delete those files when they are no longer needed, especially on shared or backed-up machines.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The CLI persists the full fetched result set, including note and comment data, to a local JSON file without an explicit user-facing disclosure or opt-in. Because comments and note metadata may contain personal or sensitive scraped content, silent retention increases the risk of unintended data exposure through shared workspaces, backups, or later exfiltration.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The CLI writes full search results to a local JSON file even though the stated skill behavior emphasizes returning structured data, not persisting it. Silent persistence can retain scraped content and user query context on disk longer than expected, increasing privacy, data handling, and accidental disclosure risk on shared or monitored systems.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The code contains local archival behavior that is not necessary for the core search-and-return function and is not clearly justified to the user. Extra storage of results expands the data footprint and creates unnecessary retention of scraped third-party content and request metadata.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The command writes the fetched detail payload to a local JSON file automatically after successful execution, but the help text and runtime messaging do not clearly notify the user that scraped content will persist on disk. In the context of a data-collection skill, this makes accidental retention of potentially sensitive public comment data more likely and expands the exposure surface beyond the immediate CLI session.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The CLI persists fetched results to a local JSON file automatically, with no explicit consent, warning, retention policy, or path control visible here. In this skill's context, scraped social-content datasets may include comment metadata, profile details, or other regulated business intelligence, so silent disk persistence increases the risk of unintended disclosure through shared machines, backups, or later exfiltration.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: Writing search results to a local file without user warning or confirmation is a transparency and privacy issue. Users may believe results are only printed to stdout, while the tool leaves behind a durable artifact containing scraped data and request details that other local users or backup systems could access.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:16