Security audit

guaikei·小红书博主笔记采集

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Xiaohongshu public-data collection helper that uses a guaikei.com API token and saves returned results locally.

Install only if you are comfortable sending Xiaohongshu keywords or URLs, including URL query parameters, to guaikei.com using your GUAIKEI_API_TOKEN. Review or delete the generated logs if the collected public comments, research keywords, or competitor URLs are sensitive for your organization.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 77% confidence
Finding: The skill requires a sensitive environment variable (`GUAIKEI_API_TOKEN`) and instructs users to invoke networked commands, but there is no explicit permission declaration or trust boundary documentation indicating secret use and external transmission. This weakens reviewability and increases the risk that operators expose tokens or run the skill without understanding that authenticated third-party access is involved.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The declared purpose says the skill is for collecting public interaction metrics, but the documented behavior extends to keyword-based discovery, creator post enumeration, full comment retrieval, and local logging. This mismatch is dangerous because users may disclose URLs, query parameters, and analysis targets under a narrower expectation, while the skill actually performs broader data collection and persistence than advertised.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The README advertises materially broader capabilities than the stated skill purpose, including keyword search, competitor monitoring, trend prediction, and comment analysis. This creates a scope mismatch that can mislead users, reviewers, or calling agents into invoking data-collection behaviors beyond the declared function, weakening governance and increasing the chance of unauthorized or noncompliant use.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The usage examples explicitly expose commands for keyword search and comment collection that go beyond the narrow manifest description of collecting creator notes and engagement metrics. Operational examples are especially risky because downstream agents or users may treat them as approved functionality and execute collection workflows that were never declared or reviewed.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The documentation significantly expands the advertised behavior from a narrow KOL engagement-data collector into a broad Xiaohongshu insight, competitor-analysis, search, detail, post, and comment collection tool. This scope drift can cause agents to invoke the skill for unrelated scraping and analysis tasks beyond user expectation or platform-policy boundaries, increasing the chance of unauthorized data collection or misuse of the token-backed API.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The skill metadata says it is for evaluating engagement quality using public note metrics such as likes, comments, and favorites, but this code retrieves full comment-task results rather than limiting collection to aggregate metrics. Collecting full comment content increases data exposure and privacy risk because user-generated text may contain personal information that is unnecessary for the stated purpose.

Context-Inappropriate Capability

Low

Confidence: 89% confidence
Finding: The code persistently writes the full final output, including retrieved comment results, to local storage without showing a clear need tied to the declared analytics purpose. Local retention expands the attack surface by leaving potentially sensitive third-party content on disk where it may be accessed later by other users, processes, backups, or logs.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The CLI persists fetched note detail results to a local JSON file after completing the request, but the skill description only frames the capability as data retrieval and analysis, not local retention. This creates an unexpected data-at-rest exposure: public note data, comments, and derived metadata may remain on disk, be accessible to other local users/processes, or be collected by backups and logs without the operator realizing it.

Context-Inappropriate Capability

Low

Confidence: 87% confidence
Finding: The skill writes retrieved creator-note results to a local file automatically, which creates unnecessary data persistence beyond the immediate CLI response. Even if the data is publicly sourced, silent retention can expose collected datasets to other local users, backup systems, or later unintended reuse, especially because filenames derive from the target URL identity.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The activation guidance is broad enough to trigger on many generic requests about understanding a Xiaohongshu creator, even when the user did not explicitly ask to send URLs or keywords to an external data provider. Over-broad triggering can cause unnecessary data sharing, unexpected API usage, and collection of creator-related targets without clear user intent.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The examples prominently encourage users to paste Xiaohongshu URLs containing query parameters such as `xsec_token`, but they do not place a clear warning nearby that these values will be transmitted to a third-party API service. That omission creates a meaningful privacy and consent risk because users may reveal tracking or access-related URL tokens without understanding the external disclosure.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The tool writes full result data to a local file without a clear warning at runtime or in the help text that output will be stored persistently. Even if the source content is publicly accessible, silently retaining scraped results can create privacy, compliance, and operational risk because users may assume the tool only prints to stdout and does not leave recoverable artifacts on disk.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The code sends the supplied profile URL and limit to a remote API task endpoint and later persists the returned results locally, but it provides no explicit disclosure or consent flow about off-device transmission and storage. In this skill context, users may assume a local analytics helper, so undisclosed network transfer and retention increases privacy and compliance risk, especially when URLs may embed tokens or identifiers.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The CLI persists full search output to a local JSON file without any explicit consent, visibility, or retention control in this file. Search results and keywords may contain sensitive business research, personal interests, or scraped public-content metadata, and silent local storage increases the risk of unintended disclosure on shared systems or through later exfiltration.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:17