小红书评论洞察

• Outcome: Review
• Latest audit: Aug 13, 2026 · 2:15 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed Xiaohongshu public-data collection tool, but users should be aware it sends requests to guaikei.com and saves complete results locally.

Install only if you are comfortable sending Xiaohongshu keywords, note/profile URLs, requested limits, and the GUAIKEI_API_TOKEN-backed requests to guaikei.com. Review and delete the generated logs when working with competitor research, public comments, or shared machines.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence
• Finding: The skill requires a sensitive environment variable (`GUAIKEI_API_TOKEN`) and invokes external tooling/API access, but does not declare explicit permissions. This creates a transparency and governance gap: operators and higher-level agents may not realize the skill can exfiltrate user-supplied URLs and retrieved data to a third-party service. In this context the behavior appears functional rather than overtly malicious, but the missing permission declaration weakens consent and review controls.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence
• Finding: The published description frames the skill mainly as blogger-post monitoring and competitor analysis, but the document defines materially broader collection behaviors: keyword search across Xiaohongshu, independent note-detail/comment scraping, and local logging of fetched results. Description-behavior mismatches are dangerous because they can cause users or orchestration systems to authorize a narrower task while the skill performs broader third-party data collection and retention than expected.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The CLI persists the full fetched result set, including note details and comments, to a local JSON file without requiring explicit user opt-in or data minimization. Even though the skill targets publicly accessible content, automatic disk persistence increases exposure by leaving recoverable artifacts on the host and may unintentionally retain large volumes of third-party content beyond the immediate analysis session.

Vague Triggers

Medium

• Confidence: 79% confidence
• Finding: The trigger rules are broad enough to auto-invoke the skill whenever a user supplies a Xiaohongshu profile link and asks about content performance, even without explicitly requesting external scraping or competitor monitoring. That increases the risk of surprise data transfer to a third-party API and unintended collection/analysis of third-party profile data without sufficiently specific user consent.

Missing User Warnings

Low

• Confidence: 81% confidence
• Finding: The skill does disclose reliance on a third-party API, but only later in the document and without prominent notice near examples and trigger guidance where invocation decisions are made. Incomplete or poorly placed disclosure is a security/privacy issue because users and calling agents may unknowingly transmit profile URLs, note links, comments, and derived data to an external service before understanding the data-flow implications.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The README states that all task results are automatically saved to the logs directory, but it does not warn that outputs may include scraped comments, interaction metrics, or account-related public data. Persistent local storage increases the chance of unintended retention, over-collection, secondary sharing, or exposure of scraped datasets, especially in shared workstations, CI runners, or team environments.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The CLI writes full comment task results to a local JSON file, which can persist potentially sensitive third-party content and analysis data on disk without an explicit runtime warning or opt-in in this file. In shared environments, CI runners, or multi-user systems, this creates an avoidable data exposure risk through leftover artifacts, backups, or overly broad file permissions.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The CLI persists fetched results to a local JSON file automatically after successful execution, but the user is not clearly warned at runtime that copied public-profile data will be retained on disk. In this skill’s context—competitive monitoring and content analysis of third-party accounts—local persistence increases privacy, compliance, and data-handling risk because scraped data may accumulate unintentionally and remain accessible to other local users, backup systems, or later processes.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The CLI persists full search output to a local JSON file without any disclosure, opt-in, retention control, or sanitization. Even if the target data is public platform content, stored results can accumulate sensitive research context such as competitor-monitoring targets, search terms, timestamps, and derived results, which increases exposure on shared machines, CI runners, or multi-user environments.

VirusTotal

63/63 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:16