guaikei-rednote-scraper

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:49 AM UTC
• Version: 1.0.0

Overview

The skill does what it says, but it handles the API token and saved scrape results in ways users should review before installing.

Install only if you trust Guaikei with your API token and query targets, and treat the generated logs as sensitive local data. Rotate the API token if exposed, delete logs you no longer need, and avoid using this in shared workspaces unless file permissions and retention are controlled.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: src/utils/request.js:76

Finding

API Credential Exposed in URL Query Strings

Content

View full analysis

{ return await postJson( "/api/xiaohongshu/note-search/keyword", { _: Date.now(), token: token }, { keyword, type, sort, time, limit }, ); ``` `src/api/detail.js:17-24`: ```js async function createDetailTask(token, url, limit) { return await withRetry( async () => { return await postJson( "/api/xiaohongshu/detail/url", { _: Date.now(), token: token }, { url: url, limit: limit }, ); }, ``` ### Technical Analysis The ap ...[truncated 1933 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: src/utils/log.js:27

Finding

Scraped Data and Token-Bearing URLs Persisted Without Restrictive File Permissions

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (52)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description is specifically about accessing public Xiaohongshu content and returning structured analytics data. The actual code shown is only a constants/config file and points to www.guaikei.com rather than an obvious Xiaohongshu-related resource. While config files alone can be supporting details, this chunk does not substantiate the declared purpose and instead references an inconsistent external resource, which is a material mismatch under the evaluation criteria.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

声明描述的是一个面向小红书公开数据采集与分析的技能，而实际代码只是底层通用参数解析模块，负责处理 CLI 输入和帮助信息输出。该代码既不访问小红书或任何外部资源，也不包含搜索、抓取、解析笔记/评论/博主作品等核心业务行为。虽然这类参数解析器可能作为更大系统的辅助组件存在，但就所提供代码片段本身而言，其实际行为与声明用途不一致，属于明显的描述-行为不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared purpose is about collecting public Xiaohongshu content and returning structured data for analysis. The provided code chunk does not perform any Xiaohongshu search, scraping, note retrieval, comment retrieval, or creator post listing. Instead, it writes content to local log files under a logs directory using fs.promises.mkdir and fs.promises.writeFile. While logging can be a supporting detail, this chunk's entire behavior is dedicated to filesystem persistence rather than the declared skill functionality. Because the actual code shown exposes an undeclared capability—writing arbitrary content to local storage—and its primary purpose in this chunk is unrelated to Xiaohongshu data access, this is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description promises substantial Xiaohongshu content retrieval and analysis capabilities. The supplied code chunk does not implement any of those behaviors; it merely reads package.json from the local filesystem and returns the package name. While this may be a harmless utility helper, the actual behavior shown is materially unrelated to the declared primary purpose, so this code chunk does not accurately represent the described skill behavior.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

md

- "分析这条小红书笔记评论区的主要观点: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

md

- "分析这条小红书笔记评论区的主要观点: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.

md

- "分析这条小红书笔记评论区的主要观点: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.

md

- "分析这条小红书笔记评论区的主要观点: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 147)May include surrounding context.

md

- "分析这条小红书笔记评论区的主要观点: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 229)May include surrounding context.

md

- "分析这条小红书笔记评论区的主要观点: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

md

- "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

md

- "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.

md

- "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 132)May include surrounding context.

md

- "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 229)May include surrounding context.

md

- "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

md

- "只拉这条笔记的评论做观点归纳: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

md

- "只拉这条笔记的评论做观点归纳: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

md

- "只拉这条笔记的评论做观点归纳: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 144)May include surrounding context.

md

- "只拉这条笔记的评论做观点归纳: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 147)May include surrounding context.

md

- "只拉这条笔记的评论做观点归纳: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 229)May include surrounding context.

md

- "只拉这条笔记的评论做观点归纳: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill declares an environment variable requirement (GUAIKEI_API_TOKEN) but does not define any explicit tool scope such as permissions or allowed-tools. That weakens least-privilege controls and can allow a runtime to grant broader capabilities than are necessary, especially for a third-party API integration that causes data egress.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The package description and keywords are entirely in Chinese, indicating the skill is presented in a single language with no mention of alternative language support or user choice. Under the policy, forcing a specific language or locale without opt-in is a natural-language policy issue unless the locale restriction is clearly documented and justified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README states that all task results are automatically saved to the logs/ directory, but it does not clearly warn users that scraped Xiaohongshu content, searched keywords, and queried URLs may be persisted to local disk. This can expose marketing research targets, monitored accounts, comment data, or other sensitive business context to anyone with access to the host, and creates unnecessary data retention risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file's natural-language documentation and runtime messages are exclusively in Chinese, with no indication that users can choose another language or locale. The stated policy flags language or locale constraints when a skill effectively forces a specific language without opt-in.

Content

No source excerpt is available for this finding.