guaikei·小红书热门清单

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:45 AM UTC
• Version: 1.0.0

Overview

The skill is a disclosed Xiaohongshu public-data retrieval tool, with manageable privacy considerations around third-party API use and automatic local result logs.

Install only if you are comfortable sending Xiaohongshu keywords, note/profile links, request limits, and the GUAIKEI_API_TOKEN to guaikei.com. Treat the generated logs as retained research records and delete or protect them if searches, target accounts, URLs, or xsec_token query values are sensitive.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill requires and uses the environment variable `GUAIKEI_API_TOKEN`, but the metadata does not declare permissions in a way that clearly exposes this sensitive capability to the host/runtime policy layer. That creates a transparency and governance gap: the skill can access secrets needed to send user queries and links to a third-party API without an explicit permission declaration, making review and containment harder.

Context-Inappropriate Capability

Medium

• Confidence: 85% confidence
• Finding: The CLI persists full search output to local storage via log.taskWrite, including user query terms and returned Xiaohongshu content. For a read-only retrieval skill, silently storing retrieved data expands the data exposure surface: local users, other processes, or future support bundles may access data the user did not expect to be retained.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The activation text is broad enough to trigger whenever a user mentions Xiaohongshu and wants to 'understand content,' even if they did not explicitly ask for external retrieval. This can cause the agent to invoke a third-party data-fetching skill unnecessarily, resulting in unintended transmission of user-provided keywords or links to an external service and reducing meaningful user consent.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: Although the markdown notes dependence on a third-party API relay, it does not clearly and prominently state that user-supplied note links, profile links, keywords, and related query data will be transmitted to `guaikei.com` during operation. This weak disclosure can mislead users and operators about data flow, creating privacy and compliance risk when potentially sensitive research targets or browsing interests are sent off-platform.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: Automatically saving task results to disk without clearly warning users can expose searched keywords, target profile URLs, note links, and analysis outputs to other local users, backups, or endpoint monitoring systems. In a marketing and competitor-intelligence context, these logs may reveal sensitive business intent or operational data even if the source content is public.

Missing User Warnings

Low

• Confidence: 91% confidence
• Finding: The CLI writes the full task output, including user-supplied URL and fetched note/comment data, to a local file automatically without clearly warning the user in this execution path. This can create unintended local data retention and privacy exposure, especially on shared machines or when the output contains sensitive content or identifiers.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The tool sends the provided Xiaohongshu URL and comment limit to remote APIs to create and fetch a detail task, but this code path does not explicitly disclose that user input is being transmitted off-host. In a data-retrieval skill this behavior is expected, but lack of clear disclosure can still create privacy and consent issues for users who may assume local-only processing.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The CLI persists the full request and returned results to a local JSON file, which can include user-supplied profile URLs, query parameters such as xsec_token, and scraped content. In this skill context, the data being handled is third-party social-media content and identifiers, so silent persistence increases privacy and token leakage risk if the host is shared, backups are collected, or logs are later exfiltrated.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: The program writes search results to a local file without any user-facing notice at the point of write or an explicit opt-in. Even if the data is not highly sensitive, unexpected persistence can leak search history and retrieved content to other local users or tools and violates user expectations for a simple query command.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:16