guaikei-xhs-check-blogger

• Outcome: Review
• Latest audit: Aug 12, 2026 · 10:39 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed Xiaohongshu public-data collection tool that uses a third-party API and local result logs, with no evidence of hidden exfiltration or destructive behavior.

Install only if you are comfortable sending Xiaohongshu keywords or URLs, requested limits, and your GUAIKEI API token to guaikei.com over HTTPS. The tool can collect up to 10000 public notes/comments/posts and saves successful results locally under logs, so review platform rules and delete retained data when no longer needed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (22)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence
• Finding: The public description frames the skill mainly as keyword search, but the documented behavior also supports fetching note details, comments, and creator profile posts from supplied URLs. This capability mismatch can cause users or orchestration layers to invoke the skill under a narrower trust model than it actually operates with, increasing the risk of unintended collection and external transmission of additional social-media data.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The README documents operational capabilities beyond the skill metadata’s stated scope, including note-detail retrieval, blogger post monitoring, and comment analysis. This creates a scope mismatch that can mislead users, reviewers, or downstream agents into invoking broader data-collection functions than were declared, weakening informed consent and security review boundaries.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The README advertises broader data-mining uses such as competitor monitoring, KOL screening, comment/sentiment analysis, and trend prediction that exceed the narrower manifest description. Even if the underlying data is public, overstating or expanding capability outside the declared scope increases the chance of misuse and reduces the effectiveness of policy and security controls tied to the manifest.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The changelog documents capabilities such as comment retrieval, note details, and creator-monitoring workflows that exceed the stated skill description limited to keyword-based public note search and interaction metrics. This creates a scope mismatch that can mislead orchestrators, reviewers, or users into invoking undeclared collection behaviors, weakening security review and consent boundaries.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: Claiming 'blogger work monitoring/scraping' introduces ongoing profile-level collection behavior not disclosed in the manifest's search-only use case. Undeclared monitoring or scraping functionality is risky because it can enable broader surveillance, unexpected data collection, and policy evasion under the cover of a narrower advertised skill.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The changelog states support for note-detail retrieval and comment sentiment analysis, which goes beyond simply returning note lists and engagement data. Hidden analytical and content-level processing capabilities increase the risk of collecting or inferring more user data than reviewers and users expect, undermining transparency and safe deployment decisions.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The documentation expands the skill from the declared keyword-search scope to four separate capabilities, including note detail, comments, and blogger post retrieval. This scope drift is dangerous because agents and users may rely on the manifest for trust boundaries, while the actual skill enables broader data collection than advertised.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The blogger monitoring/account-analysis section introduces profile-level tracking and competitive monitoring use cases beyond the manifest’s stated keyword-search function. This increases risk because it enables systematic collection and analysis of a person or account’s publishing behavior without that broader surveillance capability being clearly declared up front.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The file implements note-detail and comment retrieval, while the declared skill description is limited to keyword-based public note search, ranking, and trend comparison. This scope expansion creates a capability mismatch that can expose additional personal or content data beyond what users reasonably expect, increasing privacy and consent risk even if the target content is public.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The file exposes functionality to create and fetch published-post tasks for a specific blogger URL, which goes beyond the declared skill scope of keyword-based public note search. Scope expansion matters because users and downstream agents may rely on the manifest for consent and data-boundary expectations; hidden or undocumented collection paths can enable broader scraping than intended.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: This helper can write arbitrary content to disk under a caller-controlled filename, which exceeds the skill’s stated read-only purpose of searching public Xiaohongshu posts. Although the filename is partially sanitized to keep writes inside the logs directory, the capability still enables persistent local file creation and potential storage abuse, sensitive data retention, or misuse by other parts of the skill to save untrusted content without necessity.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: This CLI retrieves and returns note comments, which exceeds the skill’s declared scope of keyword-based discovery, ranking, and trend analysis for public notes. The mismatch increases the risk of unauthorized data handling and user surprise, especially because comments can contain personal data or sensitive user-generated content not implied by the manifest.

Description-Behavior Mismatch

Medium

• Confidence: 79% confidence
• Finding: The CLI performs full detail retrieval, including note details and comments, which goes beyond the declared skill purpose of keyword-based trend research and hot-content discovery. This scope expansion increases data collection and handling of potentially sensitive user-generated content, creating a capability mismatch that can surprise users and downstream integrators.

Context-Inappropriate Capability

Medium

• Confidence: 75% confidence
• Finding: The exposed --limit parameter enables retrieval of up to 10,000 comments, a collection capability not clearly justified by the stated use case of topic research and trend comparison. Large-scale comment harvesting raises privacy, compliance, and data-minimization concerns, especially because comments may contain personal or sensitive information.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger text is broad enough to match generic requests like '最近什么火' or '帮我找热门内容' even when the user did not clearly request Xiaohongshu. That can silently route unrelated research tasks into this skill and send user prompts or derived queries to a third-party API, creating unintended data disclosure and over-collection risk.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README states that all task results are automatically saved to the logs directory but does not warn that searched keywords, target URLs, and collected analysis outputs will be written to disk. Automatic persistence of potentially sensitive research targets or business-intelligence queries can expose user activity and collected data to other local users, backups, or unintended retention.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The document instructs users to retrieve public notes, comments, and blogger content at potentially large volumes, but it does not warn about privacy expectations, platform terms, or compliance obligations. This is risky because users may perform bulk collection or profiling of public user-generated content without understanding legal, contractual, or ethical limits.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The tool sends a target Xiaohongshu URL and API token to a backend service to create and fetch a comment task, but this file provides no explicit disclosure that user-supplied URLs and associated comment retrieval requests are transmitted off-host. This can create privacy, compliance, and trust issues because operators may not realize they are initiating external data access with authenticated requests.

Missing User Warnings

Low

• Confidence: 90% confidence
• Finding: The command writes retrieved comment results to a local JSON file after successful completion without any explicit notice or opt-in. Persisting user-generated comments locally can create unnecessary data retention risk, especially on shared systems or environments with weak filesystem controls.

Missing User Warnings

Medium

• Confidence: 72% confidence
• Finding: The code sends the provided note URL and comment limit to an external API via createDetailTask/getDetailTask without an explicit user-facing disclosure at the point of use. Even if expected by the implementation, undisclosed outbound transmission is risky because it can expose user-supplied targets and trigger remote collection of associated content.

Missing User Warnings

Low

• Confidence: 68% confidence
• Finding: The skill writes the full result payload to a local JSON file, potentially persisting note details and comments without clear notice or retention controls. Local persistence increases the risk of unintended disclosure through shared environments, log collection, backups, or later reuse beyond the original task.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The CLI persists full task results, including request details and potentially sensitive response content, to a local JSON file without user opt-in or sanitization. In shared environments, CI runners, or multi-user systems, these files can leak browsing targets, tokens embedded in URLs, or collected data beyond the user's expectation.

VirusTotal

63/63 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:16