guaikei-xhs-collector

• Outcome: Pass
• Latest audit: Aug 10, 2026 · 3:04 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed public-data collector that uses a third-party API and saves result logs locally, with no evidence of account access, hidden control, or destructive behavior.

Install only if you are comfortable sending Xiaohongshu keywords, URLs, limits, and your GUAIKEI_API_TOKEN to Guaikei's API and keeping fetched public results in local log files. Avoid using it for private, sensitive, or unauthorized collection, and clear the logs directory when the retained results are no longer needed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Context-Inappropriate Capability

Medium

• Confidence: 85% confidence
• Finding: The CLI persists the full fetched comment result set to a local file after already returning it to stdout. This creates an additional data-at-rest copy of potentially sensitive public-profile and comment data that is not necessary for the skill's stated purpose of returning structured results, increasing exposure through local file leakage, unintended retention, or collection by other processes.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The CLI writes the full collected results to a local JSON file after printing them, but this persistence is not disclosed in the visible CLI flow and is broader than a simple return-to-caller behavior. Persisting scraped profile/note data on disk increases the chance of unintended retention, later exfiltration, or access by other local users/processes, especially if the dataset contains identifiers, content metadata, or comments.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The CLI writes full search results to a local file without any apparent opt-in, path restriction disclosure, retention policy, or sensitivity controls. Even if the data is 'public', persisted result sets can contain collected profile/content metadata and search terms that create privacy, compliance, or data leakage risk on shared systems.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The tool sends the target note URL and requested limit to an external service when creating and retrieving the comment task, but the user-facing flow does not clearly disclose this transmission at execution time. Even though the skill is explicitly data-collection oriented, silent transfer of user-supplied targets to a third-party backend can create privacy, compliance, and expectation risks.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The tool silently stores fetched profile-note results to a local file without an explicit user-facing warning in the command flow. Even if the source data is public, silent retention creates privacy, compliance, and data-handling risks because users may expect transient processing rather than durable storage.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: Search results are silently persisted to disk after execution, but the user-facing flow in this file does not prominently warn that retrieved data and search terms will be stored locally. This creates a transparency and privacy issue because operators may believe the tool is read-only while it leaves durable artifacts on the host.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.