Security audit

guaikei·小红书评论舆情

Security checks across malware telemetry and agentic risk

Overview

The skill mostly matches its Xiaohongshu data-retrieval purpose, but it sends user inputs to a third-party service and automatically saves full results locally without strong user controls.

Review before installing. Use it only if you are comfortable sending Xiaohongshu keywords, note/profile URLs, and a GUAIKEI API token to guaikei.com. Treat GUAIKEI_API_TOKEN as a secret, avoid echoing or pasting it into logs or chats, verify any off-platform token source, and clear the generated logs directory if retained Xiaohongshu data is not needed.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (18)

Description-Behavior Mismatch

Medium

Confidence: 87% confidence
Finding: The README describes capabilities that materially exceed the skill metadata's narrow framing of 'returning structured JSON for downstream analysis', including broad data mining, competitor monitoring, KOL screening, trend prediction, and automatic export/logging. This kind of scope mismatch is dangerous because operators or downstream systems may grant the skill more trust, autonomy, or data access than intended, leading to unreviewed collection and retention behavior.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The changelog states the skill supports sentiment analysis and creator monitoring, which expands the apparent capability beyond the manifest's narrower description of returning structured raw data for downstream analysis. This mismatch can mislead an orchestrating agent or user into delegating higher-risk analytical tasks to the skill, causing over-trust, incorrect routing, or unintended data processing.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The changelog advertises commercial analysis, KOL screening, and trend monitoring, while the manifest says the skill only provides raw XiaoHongShu data rather than final analysis outputs. Such scope inflation creates a security-relevant documentation inconsistency because upstream agents may grant the skill broader trust or use it in decision-making contexts it was not intended or reviewed for.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: This module introduces token-gating and an off-platform private TOKEN upsell flow that is unrelated to the stated purpose of returning structured Xiaohongshu data. In an agent skill, embedding private contact and service-resumption messaging can steer operators toward unvetted channels, create supply-chain trust issues, and hide external dependency/control over functionality.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The code explicitly tells users to add a personal WeChat contact to obtain a 'private TOKEN,' which is not justified by the declared analytics-data function of the skill. This creates a social-engineering and shadow-access mechanism outside normal review and deployment controls, enabling unauthorized credential distribution, undisclosed monetization, or later abuse of users who follow the instruction.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The CLI persists the full fetched comment payload to a local JSON file after already printing results to stdout, which exceeds the stated behavior of only returning structured JSON data. This creates an unintended data-at-rest copy of potentially sensitive or regulated user-generated content, increasing exposure through local file access, backups, shared workspaces, or later accidental disclosure.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The CLI persists the full returned detail payload to a local JSON file after already printing it to stdout. Because this skill is described as only returning structured JSON for downstream processing, the extra at-rest copy can unexpectedly retain Xiaohongshu content and comments on disk, increasing data exposure through local file access, backups, or log collection.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The CLI persists the full search output to a local JSON file even though the skill description says it only returns structured Xiaohongshu data for downstream use. This creates an undisclosed secondary data sink that can retain user queries and fetched content on disk, increasing privacy, retention, and workspace exposure risk if the host environment is shared or logs are collected.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The skill description says it should be used whenever a task chain includes 'first fetch Xiaohongshu data,' which is overly broad and can cause the agent to invoke an external-data skill in contexts where the user did not clearly request it. This increases the chance of unnecessary third-party data transfer, unintended token use, and scope creep in multi-step workflows.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The invocation guidance states the skill should trigger if any one of several broad conditions is met, including loosely matched platform mentions and generalized data-seeking intent. In an agentic environment, such broad matching can lead to unintended execution against external services and expose user queries or linked content to a third-party API without sufficiently specific consent.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The execution section instructs operators to export an API token and call a third-party API, but the warning about external transmission and credential handling appears later and is not prominent at the point of execution. This can lead users or orchestrators to pass sensitive tokens and user-provided URLs/content to an external service without adequate notice, increasing the risk of credential mishandling and unintended data disclosure.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: Automatically saving task results to a local logs directory creates unannounced data persistence, which can expose scraped content, URLs, keywords, and analysis results to other local users, backup systems, or later processes. In a data-collection skill, silent retention increases privacy, compliance, and accidental disclosure risk, especially when users may assume the tool only returns transient JSON.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The file instructs users to configure `GUAIKEI_API_TOKEN` but does not identify it as a secret or warn against exposing it in logs, screenshots, prompts, or source control. In an agent/tooling context, missing secret-handling guidance increases the chance that users or upstream agents leak the token during troubleshooting or command construction, enabling unauthorized API use.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill silently writes fetched comment data to a local file without warning or consent, so users may believe the data is only transiently returned in JSON. In this skill context, the content consists of third-party social-platform comments that may contain personal data, making undisclosed local persistence more dangerous because it broadens data handling beyond the user's apparent request.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The script sends the user-supplied Xiaohongshu URL and requested comment limit to remote APIs to create and fetch a detail task, but it provides no explicit runtime warning that data will be transmitted off-host. In an agent-skill context, undisclosed network transmission is riskier because users may assume the tool only reformats local inputs into JSON rather than forwarding targets and associated metadata to an external service.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The CLI transmits the supplied Xiaohongshu profile URL and query limit to an external API, but the user-facing help text does not clearly disclose that this input will be sent off-box. In a data-processing skill, undisclosed third-party transmission can create privacy and compliance risk, especially because profile URLs may include tracking or access-related query parameters such as xsec_token.

Missing User Warnings

Low

Confidence: 82% confidence
Finding: The skill writes fetched results to a local JSON file without making that persistence behavior explicit to the user. Because the returned dataset may contain harvested profile/post metadata, silent retention increases the chance of accidental exposure through shared workspaces, backups, or later unintended reuse.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The code writes search results to a local file without an explicit user-facing warning at the point of write, while also presenting itself primarily as a data-returning skill. Undisclosed persistence can surprise users and leak sensitive search terms or collected content through local artifacts, backups, or multi-tenant filesystem access.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:16