guaikei-xhs-hot-content

• Outcome: Pass
• Latest audit: Aug 12, 2026 · 4:10 AM UTC
• Version: 1.0.0

Overview

This skill openly retrieves public Xiaohongshu search, note, comment, and creator data through a third-party API and logs results locally, with no hidden install or destructive behavior found.

Install only if you are comfortable sending Xiaohongshu keywords, note/profile URLs, and the GUAIKEI_API_TOKEN to guaikei.com, and with returned public content/comments being saved under the skill's local logs directory. Use it for public data only, avoid sensitive research terms where possible, delete logs you no longer need, and respect Xiaohongshu rules and applicable law.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (22)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence
• Finding: The public description narrowly frames the skill as recent hot-content retrieval, but the document instructs broader behaviors including note detail lookup, comment collection, creator monitoring, and varied sort/time modes. This mismatch can mislead users, reviewers, and policy engines about the actual data collection scope, increasing the risk of unintended third-party data access or invocation in contexts the user did not expect.

Description-Behavior Mismatch

Medium

• Confidence: 83% confidence
• Finding: The manifest claims the skill is not for historical lookback, but the options and examples support broader time ranges such as all time and half-year windows, as well as non-'latest' sort modes. This inconsistency can cause users or control systems to invoke the skill under mistaken assumptions about temporal scope and data minimization.

Description-Behavior Mismatch

Medium

• Confidence: 83% confidence
• Finding: The manifest claims the skill is not for historical lookback, but the options and examples support broader time ranges such as all time and half-year windows, as well as non-'latest' sort modes. This inconsistency can cause users or control systems to invoke the skill under mistaken assumptions about temporal scope and data minimization.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The README advertises a substantially broader capability set than the declared skill purpose, including competitor monitoring, KOL screening, comment analysis, and bulk data collection. This scope mismatch can mislead reviewers and users about what the skill is actually designed to do, increasing the risk of unauthorized or policy-violating data access once wired to broader tooling or APIs.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: Claims of 'trend prediction' and broad data mining go beyond the stated function of retrieving recent keyword-sorted notes. Overstating analytical power can hide undeclared processing and encourage use cases involving profiling or expanded collection that were not disclosed in the manifest.

Description-Behavior Mismatch

Low

• Confidence: 87% confidence
• Finding: Automatic persistence of all task results to a logs/ directory introduces undeclared local data retention beyond a retrieval-only skill description. Even if the data is public, silent storage can create privacy, compliance, and data-handling risks, especially for shared or multi-user environments.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The documented behavior materially exceeds the skill’s declared purpose of only retrieving recent keyword-based Xiaohongshu posts sorted by latest. It introduces additional capabilities for note-detail scraping, comment extraction, and creator post monitoring, which can cause the agent to invoke broader data-collection actions than the manifest authorizes and weaken policy/runtime assumptions about least privilege and user consent.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: Claiming the document is consistent with a newer SKILL.md while listing capabilities that do not match the current manifest creates a trust-boundary problem for the agent. This mismatch can mislead orchestration layers or reviewers into approving broader behavior than the registered skill actually permits, increasing the chance of unintended or unauthorized actions.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: This file implements functionality to create and retrieve note detail and comment data, which goes beyond the declared skill scope of only retrieving recent keyword-matched notes sorted by latest. Scope expansion is dangerous because it can silently increase data access, collect richer user/content metadata than users expect, and enable downstream use cases not covered by the skill’s stated purpose.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The implementation is materially inconsistent with the skill manifest: it creates and queries tasks for a blogger's published notes by URL, not recent keyword-based hot-content retrieval. This can cause the agent to access or return a different data domain than the user and platform expect, creating a capability mismatch that may expose unintended data and defeat security reviews based on the declared purpose.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The module comments and function documentation explicitly describe blogger-detail and published-note behavior, contradicting the manifest's stated hot-keyword trend function. In security-sensitive agent ecosystems, this kind of spec/implementation mismatch is dangerous because reviewers and users may authorize a skill for one purpose while it actually performs another, undermining least privilege and informed consent.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: This CLI fetches note comments and stores them locally, which is materially broader than the declared skill purpose of tracking recent hot-content/search trends on Xiaohongshu. That scope mismatch can lead users or integrators to grant trust, permissions, or data access under a narrower expectation, creating a deceptive-capability risk and expanding collection of potentially sensitive user-generated content.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The file implements note-detail retrieval and optional comment collection, which exceeds the manifest’s stated purpose of fetching recent keyword-sorted hot content for trend monitoring. This scope expansion increases the amount and sensitivity of collected data and creates a capability mismatch that can mislead users, reviewers, or downstream agents about what the skill actually does.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: Allowing a user-controlled comment limit up to 10,000 enables bulk harvesting that is not necessary for simple hot-topic monitoring. Even if comments are public, collecting them at this scale can facilitate profiling, dataset building, or excessive scraping beyond the declared trend-focused purpose.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The code persists retrieved note details and comments to a local JSON log file without indicating that storage is required for the declared functionality. This creates unnecessary data retention risk, especially if the output includes large comment datasets or metadata that could later be accessed, copied, or mishandled.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The CLI schema requires a blogger profile URL and labels it as such, while the skill manifest claims the tool retrieves recent notes under a keyword to monitor hot topics. This capability mismatch is dangerous because agents or users may provide topic-monitoring requests expecting keyword-based collection, but the tool instead targets a specific person’s profile content, causing unintended data collection and policy/scope violations.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The help text and input validation consistently instruct users to supply a Xiaohongshu profile URL, reinforcing behavior that contradicts the declared keyword-trend purpose of the skill. In an agent setting, this misleading interface can cause systematic misuse, collecting creator-specific data when only topical trend monitoring was authorized or expected.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The core execution path creates and fetches a post task using a profile URL and limit, confirming that runtime behavior is profile scraping rather than keyword-based hot-content retrieval. This is the most security-relevant mismatch because it operationalizes data collection outside the declared scope, increasing the risk of unauthorized surveillance, compliance issues, and trust violations in downstream automation.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: Comments and user-visible output repeatedly describe the result as 'blogger notes,' which further evidences that the implemented behavior is inconsistent with the manifest’s keyword hot-content claim. While comments alone are not exploitable, these messages amplify the risk by normalizing out-of-scope collection and making operators less likely to notice the misrepresented functionality.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The CLI sends user-supplied note URLs and retrieves comment data over the network, then writes the results to a local log file without an explicit consent notice or retention warning at execution time. Comments may contain personal or sensitive content, and silent persistence increases the risk of unintentional data retention, secondary access by other local users/processes, or policy non-compliance.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The CLI sends the supplied note URL and retrieves note details/comments from a remote service, then later writes results locally, but it does not present a clear user-facing warning or consent flow for transmission and persistence. This lack of transparency is risky because users may believe they are only doing lightweight trend inspection rather than triggering external processing and local storage.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill persists full search output to a local JSON file without explicit user consent or a warning at the write site. Search keywords and returned content may contain sensitive research topics, account-related data, or other user-interest signals, and writing them to disk creates an unnecessary retention surface that could be exposed to other local users, backup systems, or later compromise.

VirusTotal

63/63 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.