Security audit

guaikei·小红书内容雷达

Security checks across malware telemetry and agentic risk

Overview

This skill coherently retrieves public Xiaohongshu data through a disclosed third-party API, but users should understand that queries and results are sent to Guaikei and saved locally.

Before installing, be comfortable sending Xiaohongshu keywords or links and your Guaikei API token to Guaikei's service. Treat the returned data as public-platform data, avoid sensitive research targets unless appropriate, and periodically delete the local logs directory if you do not want retained copies.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The package metadata markets the tool as a broad growth, competitor monitoring, KOL screening, and user profiling solution, while the declared skill scope is limited to public Xiaohongshu search, note details, comments, and author post lists. This mismatch can mislead integrators or users into over-trusting the skill’s capabilities and encourage use beyond approved boundaries, increasing the chance of privacy, policy, or downstream abuse issues even if the manifest itself is narrower.

Description-Behavior Mismatch

Medium

Confidence: 79% confidence
Finding: The README states that all task results are automatically saved to a local `logs/` directory, which expands the skill from simple public-data retrieval into local persistence of scraped content. This creates data-retention and scope-creep risk: users may unknowingly store large amounts of third-party content, comments, or profile data on disk, increasing exposure if the host is shared, compromised, or subject to policy restrictions.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The CLI writes fetched comment results to a local JSON file after completing the request, creating a secondary copy of scraped content without explicit user consent in this flow. Even though the data is public, local persistence increases exposure by leaving recoverable artifacts on disk that may contain large datasets, metadata, or sensitive contextual information depending on the queried note and host environment.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The skill says it should be used even when the user does not mention Xiaohongshu, as long as the intent 'matches', which broadens routing beyond clear user consent. This can cause accidental invocation on ambiguous requests and send user queries or URLs to an external service when the user did not intend to use this specific third-party data source.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill acknowledges that data is relayed through a third-party API, but this warning appears late in the document and not in the main execution flow where collection and transmission are described. Users may provide links, keywords, and analysis targets without realizing their inputs and retrieved content are being sent to an external provider, creating consent and data-handling risk.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: This file silently writes the full comment results to a local JSON file after printing them, but does not provide a user-facing warning or consent mechanism for that additional storage. Silent persistence is risky because users may assume the tool only returns data to the terminal while it actually leaves a durable on-disk record that others on the system may access.

Missing User Warnings

Low

Confidence: 84% confidence
Finding: The CLI persists the full search output to a local file using a filename derived in part from user input (`keyword`) without any clear opt-in or warning at the point of execution. Even though the skill is limited to public Xiaohongshu data, saved results can still contain sensitive search intent, scraped content, or operational metadata that may remain on disk longer than expected and be accessible to other local users or processes.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:16