Security audit

小红书内容洞察

Security checks across malware telemetry and agentic risk

Overview

The skill is not malicious, but it collects broad Xiaohongshu content and automatically saves results locally, so it should be reviewed before use.

Install only if you are comfortable sending Xiaohongshu keywords or URLs to guaikei.com and saving returned public content, comments, and creator-post data under local logs. Treat comment/profile exports as sensitive business or personal data, delete logs when no longer needed, and avoid uses that violate platform rules or collect private content.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (20)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 84% confidence
Finding: The top-level description frames the skill narrowly as a trend-monitoring tool for recent keyword-sorted Xiaohongshu notes, but the body reveals materially broader collection capabilities: note details, comments, creator-post monitoring, and mention of writing outputs to local logs. This mismatch can cause users or orchestrators to invoke the skill under false assumptions, leading to over-collection of third-party data and unintended local persistence of scraped content.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The README describes capabilities far beyond the manifest's narrowly declared purpose, including competitor monitoring, KOL screening, comment analysis, note details, and bulk data extraction. This mismatch can mislead users, reviewers, and policy enforcement systems about what the skill actually does, increasing the risk of undisclosed data collection or use beyond the approved scope.

Intent-Code Divergence

Low

Confidence: 82% confidence
Finding: The documentation assures users that the tool only accesses public data and does not obtain privacy data, but elsewhere advertises comment-detail analysis and broad return of all visible valuable data. Even if the data is technically public, these claims can understate privacy and compliance risks by normalizing large-scale collection and analysis of user-generated content.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The changelog states the skill now supports comment retrieval, note details, and creator content monitoring, which materially exceeds the manifest description limited to recent keyword-sorted notes and trend monitoring. This creates a scope mismatch that can mislead reviewers, routing systems, or users into authorizing a broader data-collection capability than the published metadata indicates.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The changelog documents comment sentiment analysis and richer note-detail processing beyond the declared purpose of recent-topic/hotspot tracking. Undeclared analytical processing increases privacy, consent, and data-use risk because downstream systems may invoke the skill under narrower assumptions than what it actually performs.

Intent-Code Divergence

Low

Confidence: 84% confidence
Finding: The changelog explicitly describes broader usage scenarios, routing rules, and operational boundaries that do not match the manifest's narrow positioning. Even without executable code here, inconsistent boundary documentation can cause improper invocation, inadequate review, and underestimation of what the skill is capable of doing.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The documentation expands the skill from the declared 'keyword recent-note insights' purpose into four broader capabilities, including note details, comments, and creator post retrieval. This creates scope drift: an orchestrator or user may invoke data-collection behaviors that were not disclosed in the manifest, reducing reviewability and increasing the chance of unauthorized surveillance or over-collection.

Description-Behavior Mismatch

Medium

Confidence: 85% confidence
Finding: The keyword-search section supports broad ranking modes and long-range time windows such as 'most liked' and 'half-year', which materially exceed the stated purpose of fetching latest recent notes for hotspot detection. This can silently turn a recency-monitoring skill into a general research and historical-analysis tool, undermining least-privilege expectations.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: The competitor-analysis and KOL-monitoring guidance introduces targeted tracking of specific creators/accounts, which is not justified by a keyword-trend skill description. In context, this makes the skill more dangerous because it shifts from aggregate topic monitoring to potentially persistent profiling of individuals or organizations.

Context-Inappropriate Capability

Medium

Confidence: 84% confidence
Finding: The comment-analysis section supports sentiment, viewpoint clustering, and negative-feedback extraction, which goes beyond recent keyword trend monitoring into deeper user-generated-content analysis. That broader analytical capability can increase privacy and moderation risk, especially when users expect only topical trend summaries.

Description-Behavior Mismatch

High

Confidence: 92% confidence
Finding: This file implements creation and retrieval of comment-collection tasks, which materially expands the skill from stated hot-topic/recent-note insight gathering into harvesting user-generated comment data. In the context of a skill described as trend monitoring for recent Xiaohongshu notes, this is a scope mismatch that can enable unnecessary collection of potentially sensitive or profile-bearing data and increases privacy/compliance risk.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The file implements creation and retrieval of full note-detail and comment-fetching tasks, which goes beyond the stated skill purpose of monitoring recent keyword-based trend activity. This scope expansion increases data access to detailed content and comments that are not necessary for hotspot detection, creating a data minimization and over-collection risk if exposed through the skill.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: Allowing retrieval of detailed note data with a comment limit up to 10,000 is disproportionate to the declared purpose of trend monitoring, which typically requires only summary-level signals. This increases the privacy and misuse surface by enabling bulk collection of user-generated comments unrelated to the minimum data needed for the feature.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The file implements blogger-profile published-post task creation and retrieval endpoints, while the skill manifest describes a keyword-based recent-topic insight capability. This mismatch is dangerous because agents and users may invoke the skill under false assumptions, causing unintended data collection, privacy-impacting access patterns, or use of the wrong external API surface. In a security review context, capability misrepresentation is a real integrity issue because it can bypass policy gating and make downstream systems trust behavior the skill does not actually provide.

Context-Inappropriate Capability

Medium

Confidence: 82% confidence
Finding: The CLI persists fetched comment results to a local JSON file, which can retain potentially sensitive or regulated user-generated content on disk longer than necessary. In shared environments, CI runners, or multi-user systems, these logs may be accessed by unintended parties, creating a confidentiality and data-retention risk.

Description-Behavior Mismatch

Low

Confidence: 86% confidence
Finding: The code writes fetched note details and comments to a local file without any user opt-in, retention control, or sensitivity check. Persisting scraped content can create unintended data exposure on shared systems, leave recoverable artifacts, and broaden the privacy/security impact beyond transient CLI output.

Description-Behavior Mismatch

Low

Confidence: 83% confidence
Finding: The CLI writes full search results to a local JSON file without making that persistence a clear, explicit part of the skill's behavior. If results contain sensitive queries, account-linked data, or business research topics, this creates a local data-retention risk and increases exposure to other local users, backups, or log collectors.

Missing User Warnings

Low

Confidence: 80% confidence
Finding: The tool writes fetched comments to a local JSON file without clearly informing the user at runtime, which can surprise users and leave persistent artifacts containing scraped content. While not severe on its own, it increases privacy and operational risk, especially on shared hosts or ephemeral environments where logs may be collected automatically.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill persists fetched results to a local JSON file automatically, without clear user consent or a visible warning before writing. Because results may include profile-derived content and metadata, silent disk persistence can expose data to other local users, backups, or later processes, especially in shared or managed environments. In this skill context, the data appears to be publicly sourced Xiaohongshu content, which reduces severity, but undisclosed persistence still creates avoidable privacy and retention risk.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: Persisting network-derived search results to disk without clear user warning can surprise users and leave behind sensitive artifacts. This is especially relevant for a trend-monitoring skill because keywords may reflect confidential campaign plans, internal research topics, or personal interests that become recoverable from local storage.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:15