guaikei-xhs-comment-data

• Outcome: Review
• Latest audit: Aug 12, 2026 · 9:49 AM UTC
• Version: 1.0.0

Overview

The skill needs Review because it is named and described as comment-only but also enables broader Xiaohongshu search, note-detail, and creator-post collection through a third-party API with automatic local result logging.

Install only if you intend to use a broader Xiaohongshu public-data collection toolkit, not a narrowly scoped comment-only helper. Expect URLs, keywords, limits, and your GUAIKEI_API_TOKEN to be sent to guaikei.com, and expect returned data to be saved under logs automatically. For comment-only use, restrict invocation to comment-cli.js and avoid the search, detail, and post commands unless the broader collection is explicitly desired and permitted.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (21)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill is presented as a narrowly scoped comment-only capability, but the file clearly routes to search, detail, and creator-post retrieval commands as well. This mismatch can cause the agent or user to invoke broader data collection than intended, undermining informed consent, policy enforcement, and any safeguards that rely on the declared purpose.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The package metadata advertises a broad Xiaohongshu analytics and growth toolkit, while the declared skill purpose is narrowly limited to comment retrieval and analysis. This scope mismatch is dangerous because it can cause an orchestrator or reviewer to trust and invoke a package with capabilities beyond the least-privilege expectations of the skill, increasing the chance of unintended data access or misuse.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The package exposes search, detail, and post command surfaces even though the skill is supposed to only retrieve comments. Unjustified extra capabilities materially expand the attack and misuse surface, because a caller, agent, or future integration could invoke unrelated collection functions and access note details or broader platform data outside the user's requested scope.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The README presents the skill as a broad Xiaohongshu data-mining and marketing toolkit, including competitor monitoring, trend prediction, KOL screening, and bulk public-data extraction, while the manifest says the skill should only fetch comment data for a single note. This scope mismatch is dangerous because users, reviewers, or downstream agents may invoke or trust capabilities outside the declared boundary, undermining least-privilege expectations and enabling unintended data collection or policy bypass.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The usage examples and scenarios explicitly document non-comment commands such as keyword search, note detail retrieval, and creator post monitoring, contradicting the manifest's read-only comment-analysis scope. This is risky because it operationalizes out-of-scope collection behavior and may cause an agent or operator to run broader scraping workflows under the guise of a narrowly approved skill.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The changelog documents materially broader capabilities than the current skill metadata, including keyword search, note details, and creator monitoring. This scope mismatch can cause operators or downstream agents to invoke the skill with assumptions that exceed its declared boundaries, increasing the risk of over-collection, unintended data access, or misuse of hidden functionality.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The changelog states the skill added note-detail retrieval and sentiment analysis, which conflicts with the current claim that it only fetches comments and not note body content. This direct intent-level inconsistency is dangerous because it undermines trust in declared data-handling limits and may lead to collection or processing of content outside the user-approved scope.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The implementation fetches and returns full note-detail data in addition to comments, including reconstructed note and user profile URLs, which exceeds the declared comment-only scope of the skill. This creates a capability mismatch: users and reviewers may believe only comment data is processed while the code also collects broader content and metadata, increasing privacy and data-minimization risk.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The module comments and function documentation explicitly describe note-detail-plus-comment behavior, contradicting the published skill description that says the skill is comment-only. This inconsistency is security-relevant because it can mislead operators, users, and auditors about what data the skill accesses and returns.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The code retrieves blogger details and published posts via `/api/xiaohongshu/post/url` and `/api/xiaohongshu/post/info`, which does not match the skill’s declared purpose of comment-only retrieval for a specific note. This capability mismatch is dangerous because an agent or user may invoke the skill expecting scoped comment analysis, but the implementation can collect broader author/post data, causing unintended data access, over-collection, and policy bypass within an agent ecosystem.

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The function documentation explicitly describes blogger URL and published-note operations, contradicting the manifest’s comment-only purpose. This inconsistency increases the risk of misuse and unsafe orchestration because reviewers, agents, or downstream tooling may trust the manifest while the code and docs signal broader collection behavior.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: The skill manifest says it should retrieve comment content only, but this CLI calls detail.createDetailTask/getDetailTask and returns the entire detailTask object as results. If that object contains note正文 or other metadata, the skill exceeds its declared data scope and can expose more user/content data than expected, which is especially risky in agent contexts where downstream components rely on the manifest for permission boundaries.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The code writes the full finalOutput, including raw results: detailTask, to a local file without filtering. When the upstream response includes note body or broader detail data, this creates persistent storage of out-of-scope content and increases exposure through local retention, later reuse, or accidental disclosure.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The implementation materially diverges from the skill’s declared purpose: it accepts a blogger profile URL, creates a post task, and retrieves homepage notes instead of fetching comments for a specific note. In an agent setting, this can cause unauthorized over-collection and disclosure of broader profile content than the user intended, breaking least-privilege and creating data-scope confusion that can expose additional personal or behavioral data.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The CLI text repeatedly tells operators this command takes a blogger link and returns homepage notes, which directly contradicts the manifest’s comment-only description. This mismatch can mislead users, agents, or reviewers into invoking a broader data collection path than expected, increasing the chance of unintended scraping and privacy-impacting use.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This CLI implements keyword-based Xiaohongshu content discovery and returns note search results, which exceeds the stated skill purpose of retrieving comments for a specific note only. In this skill context, broad discovery materially increases data collection scope and can be used to enumerate unrelated content, making the mismatch security-relevant rather than a harmless feature gap.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The file exposes generalized discovery controls such as keyword, type, sort, time, and limit, enabling broad exploration of Xiaohongshu content unrelated to comment analysis for a given note. Because the skill is advertised as comment-only retrieval, this capability expansion weakens least-privilege boundaries and makes misuse for scraping or surveillance easier.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger rules allow the skill to activate based on vague signals such as any XHS link plus general interest in audience feedback, even when the user did not explicitly request comment retrieval. Over-broad invocation increases the chance of unnecessary third-party data transfer and collection beyond user intent, especially because the skill can route into broader data-fetching modes.

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: The description is broad marketing copy for a general-purpose analytics tool and does not clearly constrain when the skill should be invoked. In agent environments, vague trigger scope can lead to over-invocation on loosely related tasks, exposing users to unnecessary data collection or use of a more powerful tool than intended.

Missing User Warnings

Medium

• Confidence: 80% confidence
• Finding: This command sends the provided note URL and API token to a remote detail service and then writes returned data to disk, but the user-facing flow does not prominently warn that data will be transmitted to an external API and stored locally. In a data-collection skill handling comments and commenter information, that lack of transparency can cause unintended disclosure or retention of potentially sensitive content.

Missing User Warnings

Low

• Confidence: 76% confidence
• Finding: The tool writes fetched results to a local file automatically, which can persist scraped data on disk without clear user consent or visibility. In this skill context, the data may include profile-related content beyond the manifest’s intended comment-only scope, so silent persistence increases privacy and data-handling risk on shared systems.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:16