Security audit

guaikei-xhs-data-finder

Security checks across malware telemetry and agentic risk

Overview

This Xiaohongshu data skill is coherent overall, but it warrants Review because it can bulk fetch public comments/profile data and automatically save full results locally without an opt-out.

Install only if you are comfortable sending Xiaohongshu keywords, note/profile URLs, limits, and API-token-authenticated requests to Guaikei, and with full fetched results being saved under the skill’s logs directory. Use it only for public data you are allowed to process, keep targets scoped, and plan to delete or protect saved logs if they contain comments, user/profile data, or sensitive research interests.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (23)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The top-level description markets the skill as a keyword search tool, but the body expands behavior to note detail retrieval, comment harvesting, and creator-post monitoring. This mismatch can cause users or calling agents to authorize or invoke broader data collection than expected, increasing privacy, compliance, and data-exfiltration risk through an external API.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The README expands the skill from keyword-based public note discovery into note-detail retrieval, account monitoring, KOL screening, and comment analysis. This scope mismatch is dangerous because users and platform reviewers may grant the skill broader access or use than they expect, increasing the chance of undocumented data collection and policy-violating surveillance-style use.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: Advertising competitor monitoring and trend prediction goes beyond a narrow content-discovery/search skill and signals broader analytics and surveillance capabilities than the stated purpose suggests. In this context, the mismatch matters because the skill targets social-media data mining, where undeclared expansion of purpose can lead to misuse, non-compliant collection, and user misunderstanding about what the tool actually does.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The changelog advertises capabilities beyond the manifest’s stated scope, including comment retrieval and differentiated routing for note details and creator monitoring. This creates a scope mismatch that can mislead users, reviewers, or orchestration layers into invoking undocumented data-access behaviors, weakening consent, review accuracy, and policy enforcement.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The changelog claims blogger/creator work monitoring and scraping functionality not reflected in the declared skill purpose. Hidden or undocumented monitoring features are security-relevant because they expand collection and surveillance behavior beyond what users and platform controls expect.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: Documented support for note-detail retrieval and comment sentiment analysis exceeds the manifest’s described keyword-search-only scope. This discrepancy can bypass normal scrutiny by hiding higher-sensitivity processing behind seemingly narrower functionality, increasing the risk of unauthorized data handling or deceptive deployment.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The documentation advertises detail, comment, and author-post retrieval capabilities beyond the manifest's stated keyword-search scope. This creates a scope mismatch that can mislead orchestrators, reviewers, or users into invoking broader data-collection behavior than was approved, weakening least-privilege and policy enforcement.

Description-Behavior Mismatch

Low

Confidence: 85% confidence
Finding: The documented workflows extend into competitor and KOL monitoring use cases not clearly stated in the manifest. While not inherently malicious, this broadens the operational purpose of the skill and can enable surveillance-style usage or unauthorized business-intelligence collection beyond expected user intent.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: This file adds a comment-collection capability by creating tasks against a comment endpoint, which exceeds the declared skill scope of searching public notes and returning note lists plus interaction metrics. Scope drift is security-relevant because users, reviewers, and policy controls may rely on the manifest to understand what data the skill can access; undisclosed collection of comments increases privacy and abuse risk.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The result retrieval path returns comment arrays from a comment info endpoint rather than the manifest-described note search results. That mismatch can lead to hidden data handling beyond expected scope, undermining informed consent, review accuracy, and downstream safety assumptions about what the skill returns.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The CLI implements comment retrieval for a note, which exceeds the skill's declared purpose of keyword-based public note search, ranking, and trend/topic research. This scope expansion matters because comments can contain additional user-generated content and potentially personal data, increasing privacy and compliance risk beyond what users and reviewers would expect from the manifest.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The code creates and fetches a remote comment task using the supplied note URL and limit, adding a scraping capability not justified by the stated business need of popularity/topic research. Even for public notes, bulk comment extraction can expose sensitive user content, create policy violations, and enable downstream profiling or dataset accumulation.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The file performs note-detail and comment retrieval by creating and polling a remote detail task, which goes beyond the manifest description that emphasizes keyword-based public note search. This capability mismatch is dangerous because it can cause users or host platforms to underestimate what data is being fetched and processed, reducing informed consent and weakening review-time security assumptions.

Description-Behavior Mismatch

Medium

Confidence: 85% confidence
Finding: The CLI writes fetched results to a local JSON log file after execution, creating persistent storage of scraped profile/post data without an explicit user-facing warning or opt-in in this command path. Even if the source data is public, local persistence can expand exposure by leaving a recoverable artifact on disk, especially on shared machines, CI runners, or agent environments handling multiple users' tasks.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The CLI writes full search output, including user-supplied keywords and returned content data, to a local JSON file after completing a search. For a search-only skill, this creates unnecessary persistent storage of potentially sensitive research activity without explicit consent, retention controls, or indication of where the data is stored.

Vague Triggers

Medium

Confidence: 85% confidence
Finding: The trigger guidance includes very broad phrases like '最近什么火' and '帮我找热门内容', which overlap with ordinary conversation and can cause accidental invocation. In this skill's context, misfires are more concerning because execution may send user-supplied queries or links to an external service using an API token, potentially exposing user intent or data without clear consent.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The README states that all task results are automatically saved to the logs directory, but it does not clearly warn that fetched note data, comment content, URLs, and search terms may be persisted locally. This creates a data-handling risk because operators may unknowingly retain potentially sensitive or regulated content on disk, expanding exposure through shared machines, backups, or accidental disclosure.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The program writes the full comment task output to a local JSON file without prominently informing the user that retrieved data will persist on disk. Local persistence increases the risk of unintended retention, later disclosure to other users/processes on the host, and accumulation of scraped comment datasets beyond the immediate task.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The CLI transmits the provided note URL and requested comment limit to remote APIs without clearly warning users that inputs are sent off-box. While network transmission is expected for an API-backed skill, the absence of explicit disclosure is still a transparency and privacy issue, especially because the action involves comment retrieval rather than only metadata search.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The CLI transmits the user-supplied note URL and comment limit to remote APIs via createDetailTask/getDetailTask, but does not clearly warn the user at execution time that their inputs will be sent off-host. That matters because even public-content URLs can reveal user research targets or operational context, and silent transmission undermines transparency and informed use.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The script persistently writes the full fetched result set to a local JSON file without a clear user warning or opt-in. Even if the source content is public, stored results can include large comment datasets, research history, and metadata that become locally accessible to other users, backups, or later processes.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The command silently persists the full output to a local file using a filename derived from the target URL, but the help text does not clearly warn about persistent storage. This can surprise users and leak collected data to disk, backups, logs, or other local users/processes, which is more sensitive in an agent skill context where operators may expect read-only retrieval.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: Search results are silently written to disk with no user-facing warning or consent flow, which can expose a user's search interests and collected content to other local users, backups, or later compromise of the host. The risk is elevated because the filename also embeds the keyword, further leaking query data even if the file contents are not opened.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.