Security audit

小红书博主洞察

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed Xiaohongshu public-data retrieval skill that uses a third-party API and saves results locally, with no hidden installation, account-control, or destructive behavior found.

Install only if you are comfortable sending Xiaohongshu keywords or note/profile URLs, including any xsec_token query values in those URLs, to guaikei.com using your GUAIKEI_API_TOKEN. Review and delete the generated logs when they are no longer needed, and use lower --limit values when collecting comments or public posts.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (16)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 88% confidence
Finding: The top-level description frames the skill narrowly as blogger engagement assessment, but the documented behavior is broader: keyword-wide search, comment scraping, local logging, and outbound requests to a third-party service. This mismatch can cause users or orchestrators to invoke the skill without realizing it performs broader collection and data egress, increasing privacy, compliance, and unintended data-handling risk.

Description-Behavior Mismatch

Medium

Confidence: 84% confidence
Finding: The manifest description understates the scope of the skill by emphasizing engagement assessment while the body also supports broad topic search, competitor analysis, and comment scraping. Understated scope is dangerous because policy engines and users may grant trust or approval based on a narrower use case than what the skill can actually do.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The README presents the skill as a broad Xiaohongshu data-mining and trend-monitoring tool, which materially exceeds the manifest’s stated purpose of blogger-insights and engagement evaluation. This mismatch can cause users or downstream agents to invoke the skill for unintended collection and monitoring tasks, weakening scope boundaries and increasing the chance of policy or privacy-unsafe use.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The usage section explicitly advertises keyword search, hot-topic discovery, and broader monitoring workflows that go beyond the declared blogger-insights scope. In practice, this expands operational behavior from narrow evaluation into generalized scraping and surveillance use cases, which increases the risk of unauthorized or non-compliant data collection.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The documentation materially expands the skill from blogger/post engagement insight into broader keyword search, competitor analysis, and general Xiaohongshu content research. That scope drift increases the chance the agent will invoke collection or analysis behaviors not disclosed in the manifest, weakening user consent, policy gating, and least-privilege assumptions around what the skill is supposed to do.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The standalone comment-harvesting capability goes beyond a narrow 'real engagement metrics' use case and enables bulk retrieval of user-generated discussion content. Even if the comments are public, this broadens the data-processing surface into content collection and downstream sentiment/opinion analysis, which may create privacy, compliance, and misuse concerns beyond the stated skill purpose.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The skill manifest says the capability is limited to blogger/public-work and single-note engagement insight retrieval, but this code creates arbitrary keyword-based note search tasks. That materially broadens collection and discovery capability beyond the declared scope, enabling large-scale content enumeration and prospecting rather than narrow engagement analysis. In this skill context, the mismatch is more concerning because the product is intended for KOL evaluation, where keyword search can be repurposed for broader surveillance or lead discovery.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The CLI persists the full comment task output to a local JSON file after completing the request, which goes beyond transient command output and creates a durable copy of potentially sensitive scraped engagement data. In this skill’s context, the data relates to public social-media content, so the privacy impact is moderated, but silent retention still increases exposure through unintended local disclosure, reuse, or collection outside the stated analytics purpose.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The CLI appears capable of retrieving full note details and comments via the detail task, while the skill description says it is intended to assess public engagement quality rather than broadly expose note/comment content. This expands data collection beyond the declared scope and can unnecessarily process or disclose user-generated content, increasing privacy and compliance risk even if the source data is public.

Description-Behavior Mismatch

Low

Confidence: 93% confidence
Finding: The code writes the full result payload to a local JSON file, which may include note metadata, URLs, and comment content. Persisting fetched data creates an avoidable retention surface: sensitive or regulated content can remain on disk longer than necessary and be accessed by other local users, backups, or downstream tooling.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The CLI returns general Xiaohongshu search results rather than being narrowly constrained to blogger/note engagement analysis described in the skill metadata. In an agent setting, this scope expansion can let downstream users or automations use the skill for broader content discovery and data collection than intended, weakening policy boundaries and increasing misuse risk.

Vague Triggers

Medium

Confidence: 77% confidence
Finding: The activation guidance is broad enough that the skill may trigger on generic requests about a creator's engagement even when the user has not clearly asked for external data retrieval or third-party processing. Over-broad triggering can lead to unnecessary collection, external API calls, and disclosure of URLs or research targets to the vendor service.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The tool writes fetched comment results to disk without an obvious inline warning or explicit user consent in the execution flow, which can surprise users and leave behind local artifacts containing collected data. Even if the source content is public, silent persistence increases the chance of unauthorized access, accidental sharing, or misuse on shared systems.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The note URL is sent to the external API and then included in stdout output and local persisted logs, but the CLI does not clearly warn the user that this identifier will be transmitted and stored. Even if the note is public, the URL can contain tracking or access parameters and may reveal user investigative targets, creating unnecessary privacy and operational exposure.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The CLI writes the full task output to a local JSON file derived from the target profile URL without clearly informing the user in this file that data will be persisted. Because the output includes the queried URL, metadata, and retrieved results, this can create unintended local retention of potentially sensitive research data on shared machines or in automated environments.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The script sends the supplied profile URL and limit to external API functions after validation, but the user-facing flow in this file does not clearly disclose that these inputs will be transmitted to a remote service. In this skill’s context, users may provide profile links containing query tokens such as xsec_token, so silent transmission can expose tracking or access-related parameters to a third party.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:15