Security audit

guaikei-xhs-comment-grabber

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent public Xiaohongshu analytics tool, but it sends tokens and targets to a third-party API and automatically saves fetched results locally, so users should review it before installing.

Install only if you are comfortable sharing your GUAIKEI API token, Xiaohongshu keywords, target URLs, and requested limits with guaikei.com. Treat returned comments and profile data as potentially personal information, use explicit limits, avoid private or unauthorized targets, and delete or protect the generated logs if they contain sensitive business or personal data.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 87% confidence
Finding: The skill description promises a narrower purpose than the documented behavior, while the body reveals broader scraping, comment collection, profile monitoring, and local log storage. This is dangerous because users and policy layers may authorize the skill for limited analytics but unknowingly permit more extensive data collection and retention, increasing privacy, compliance, and data-handling risk.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The README materially expands the advertised behavior from engagement-metrics analysis into broad data mining, competitor monitoring, trend prediction, and bulk collection. That scope drift is dangerous because users and reviewers may grant the skill access or approval based on the narrower manifest while the documentation encourages more invasive collection and surveillance-oriented use cases.

Intent-Code Divergence

Medium

Confidence: 81% confidence
Finding: The README states the tool does not obtain user privacy data, yet it also advertises fetching detailed comment content and interaction data. Even if sourced from public pages, comment text can contain personal or sensitive information, so this claim can mislead users into underestimating privacy and compliance risk.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The documentation advertises broader capabilities such as keyword search and competitor analysis beyond the skill metadata, which only describes fetching public creator works and note interaction data. This scope expansion is dangerous because it can cause the agent to invoke unreviewed scripts or handle inputs and data flows that were not covered by the declared trust boundary, increasing the chance of unauthorized collection or misuse.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The CLI persists fetched note/comment results to a local JSON log file after successful retrieval. Even if the data is from publicly accessible pages, storing full results locally creates an unnecessary data retention surface, may capture comment text or metadata users did not expect to persist, and expands the behavior beyond simple retrieval/display.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The CLI writes full search results to a local JSON log file whose filename includes the user-supplied keyword. Even though the skill is analytics-focused, persisting potentially sensitive query terms and returned content locally increases data exposure risk, especially on shared systems or when logs are collected, synced, or left unprotected.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The README mentions that all task results are automatically saved to the logs directory, but does not clearly warn users that fetched content and comments will be persisted locally. Silent local storage increases the chance of unintended retention, secondary disclosure, or mishandling of scraped data, especially on shared machines or in synced workspaces.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The function sends the caller-supplied API token to a remote endpoint as a request parameter, and this file provides no indication of consent flow, minimization, or protection against disclosure through logs, intermediaries, or downstream services. In the context of a third-party scraping/data-access skill, transmitting credentials off-box is security-relevant because token misuse could enable unauthorized API use or account abuse if the transport or backend handling is weak.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: This request transmits both the API token and the requested Xiaohongshu URL to a remote API, which exposes sensitive user intent and credentials to an external service. Because the skill is specifically designed to retrieve social-platform data, the context increases privacy sensitivity: queried targets, collection limits, and tokens together can reveal business intelligence and may be abused if intercepted or mishandled.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: This command performs authenticated network retrieval using a token and then writes the resulting data to disk, but this file provides no explicit notice, consent, or control over persistence. That combination increases privacy and compliance risk because operators may believe the tool only queries live data while it actually creates retained local copies of fetched content.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.