Security audit

guaikei·小红书扒评论看舆情

Security checks for vulnerabilities and agentic risk

Overview

This skill is a public Xiaohongshu data retrieval tool with disclosed API-token use and local result logging, but users should know outputs are saved to disk.

Install only if you are comfortable sending Xiaohongshu keywords or links, plus the GUAIKEI_API_TOKEN, to the guaikei.com API. Expect successful results to be saved under the package's logs directory; delete those files if they contain sensitive research topics or URLs you do not want retained locally.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The README markets the skill as providing 'deep' competitor monitoring, trend prediction, KOL screening, batch operations, exports, and broad analytics, while the manifest scope is limited to retrieval of public Xiaohongshu data. This kind of capability overstatement can mislead operators into granting broader trust or using the skill for purposes outside its declared scope, weakening security review and policy enforcement even if no direct exploit is shown in this file.

Description-Behavior Mismatch

Low

Confidence: 95% confidence
Finding: The README states that all task results are automatically saved to a local logs/ directory, but this persistence behavior is not disclosed in the manifest description. Undisclosed data retention increases risk because users and orchestrators may assume results are transient, while public-content queries, URLs, keywords, and analysis outputs may accumulate on disk and be exposed to other local users, backups, or later exfiltration.

Description-Behavior Mismatch

Medium

Confidence: 87% confidence
Finding: The CLI persists full search results to a local JSON file after completing the request, which creates a secondary data store not disclosed in the skill description or user-facing flow. Even if the source data is public, silently retaining query terms and result sets can expose user interests, create unintended data accumulation on disk, and broaden the blast radius on shared or multi-tenant systems.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The CLI writes the full result payload, including user-supplied URL-derived context and retrieved public profile/post data, to a local JSON file without explicit notice or opt-in. In shared environments, CI runners, or agent sandboxes, this can create unintended data retention and secondary exposure through local disk, artifact collection, backups, or later reads by other processes.

Missing User Warnings

Low

Confidence: 84% confidence
Finding: The program writes search results to a local file without informing the user in its help text or normal success output, which undermines user expectations about where data goes. This can lead to unnoticed residual files containing keywords and retrieved content, especially on shared workstations or ephemeral automation runners.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:16