Security audit

guaikei-xhs-insight-extractor

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent Xiaohongshu data-collection tool, but it needs review because it can bulk collect comments/profile content through a third-party API and automatically save results locally without strong opt-out or retention controls.

Install only if you are comfortable sending Xiaohongshu keywords, note/profile URLs, requested limits, and the GUAIKEI API token to guaikei.com. Treat returned public comments and creator data as potentially sensitive, review platform/compliance obligations, and delete or protect the generated logs because the skill saves full results locally by default.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (23)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The top-level description narrows the skill to keyword-based Xiaohongshu search, but the body documents broader capabilities: note detail retrieval, comment extraction, creator monitoring, and local log writes. This mismatch is dangerous because users or orchestrators may invoke the skill under a narrower trust assumption, leading to over-collection of public-but-sensitive social data and unintended local persistence.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The README materially expands the skill’s scope from a keyword-based insight extractor to broader competitor monitoring, trend prediction, KOL screening, and marketing analysis. This mismatch can mislead users and reviewers about what the skill actually does, weakening informed consent and increasing the chance the agent is used for higher-risk data collection tasks than its manifest suggests.

Description-Behavior Mismatch

Low

Confidence: 83% confidence
Finding: The README advertises automatic export, broad data return, and log/result persistence without corresponding disclosure in the manifest. Undisclosed persistence is risky because users may assume transient processing while the skill stores fetched content locally, potentially exposing scraped data or sensitive URLs on disk.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The documented commands include note-detail extraction, account monitoring, and comment analysis, which go beyond the manifest’s stated keyword-search use case. This scope drift is dangerous because it enables more invasive profiling and monitoring behaviors than users or platform governance may expect from the declared skill.

Intent-Code Divergence

Low

Confidence: 81% confidence
Finding: The README claims minimal privacy impact while elsewhere documenting comment scraping, competitor monitoring, and returning all valuable visible data. These conflicting statements can downplay the sensitivity of collected public content and cause users to underestimate the privacy and compliance implications of bulk collection and analysis.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The documentation materially expands the skill from a manifest-described keyword-search insight extractor into four separate capabilities, including note details, comments, and author post harvesting. This scope drift is dangerous because agents may invoke data-collection behaviors users and platform reviewers did not expect, weakening least-privilege assumptions and enabling broader scraping or surveillance than the declared purpose allows.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The file documents author-profile querying and bulk comment harvesting even though the stated skill purpose is keyword-based public-note insight extraction. Those extra collection paths increase privacy and abuse risk by enabling targeted monitoring of individual creators and large-scale comment scraping outside the narrow user expectation set by the manifest.

Description-Behavior Mismatch

High

Confidence: 94% confidence
Finding: This code adds a comment-scraping capability that is not described in the skill manifest, which says the skill searches public Xiaohongshu notes and returns note metadata/content insights. Hidden or undocumented data-collection features are dangerous because they expand the skill’s effective permissions and can collect user-generated content beyond user and platform expectations, increasing privacy, compliance, and misuse risk.

Description-Behavior Mismatch

High

Confidence: 94% confidence
Finding: Fetching comment task results further confirms that the skill implements an undisclosed comment-harvesting workflow rather than only returning note-level search results. Because comments may contain additional personal or sensitive user content, this scope mismatch materially increases data exposure and can mislead users or operators about what the skill actually retrieves.

Description-Behavior Mismatch

High

Confidence: 89% confidence
Finding: This CLI creates and fetches comment tasks, which goes beyond the declared skill purpose of searching public Xiaohongshu notes and returning note-level metadata and summaries. Scope expansion matters because it collects additional user-generated content that may include personal data, increasing privacy and compliance risk without clear justification or disclosure in the skill contract.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The skill metadata says it is for keyword-based Xiaohongshu search returning titles, summaries, authors, metrics, and links, but this CLI fetches full note details and comments from a note URL. That is a capability expansion beyond the advertised scope, which can mislead users or orchestrators into authorizing broader data collection than expected.

Description-Behavior Mismatch

Low

Confidence: 90% confidence
Finding: The code writes fetched results, including note details and comments, to a local JSON log file without that persistence being apparent from the skill description. Undisclosed local retention increases exposure of scraped content and may surprise operators who expected transient read-only behavior.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: The CLI schema and help text clearly implement a blogger profile URL workflow, while the manifest describes a keyword-based Xiaohongshu insight extractor. This mismatch is dangerous because users or orchestrators may invoke the skill expecting broad social-media keyword analysis, but the code instead targets a specific profile endpoint and can collect a different class of data than advertised, undermining consent, review, and policy controls.

Description-Behavior Mismatch

High

Confidence: 94% confidence
Finding: The returned payload is labeled as successful completion of a 'post' task and contains blogger homepage notes rather than keyword/topic insight extraction promised in the manifest. This creates a scope-confusion vulnerability: downstream agents may trust the declared purpose while actually receiving profile-derived content, which can bypass least-privilege assumptions and cause collection or use of data outside the reviewed use case.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The CLI writes the full search output to a local JSON file, including the user’s keyword and returned content metadata, even though the skill description only indicates returning search results. This creates an undocumented data persistence channel that can leak user activity, sensitive research topics, or collected content to other local users, backup systems, or later processes.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The description says the skill can be used even when the user did not explicitly request Xiaohongshu search, as long as the intent resembles understanding social-media performance. That broad routing rule can cause unintended third-party data access and external transmission of user-provided topics or links without sufficiently explicit consent, especially in an agentic environment with automatic tool selection.

Missing User Warnings

Low

Confidence: 88% confidence
Finding: The documentation notes automatic saving of task results to a local logs directory but does not present this as a prominent warning in the skill description. Silent or under-disclosed local persistence can leak scraped content, keywords, URLs, and analysis artifacts to other local users, backups, or endpoint tooling.

Missing User Warnings

Medium

Confidence: 74% confidence
Finding: The code places both the API token and the user search keyword into GET query parameters. Query parameters are more likely to be exposed via logs, proxies, monitoring systems, browser history, or intermediary infrastructure than request bodies, so sensitive credentials and potentially sensitive search terms may leak beyond the intended recipient.

Missing User Warnings

Medium

Confidence: 85% confidence
Finding: The tool writes retrieved comment results to a local JSON file without any explicit opt-in, warning, retention policy, or data minimization. Persisting social-media comment data can create unnecessary exposure if the host is shared, logs are harvested, or the file is later reused outside the user's expectations.

Missing User Warnings

Medium

Confidence: 81% confidence
Finding: The CLI sends the supplied note URL and requested limit to external API methods, but this network transmission is not clearly disclosed as part of the user-facing skill behavior. Even if expected operationally, undisclosed outbound transfer of user-provided targets and retrieval parameters creates transparency and privacy concerns, especially when combined with comment harvesting.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The CLI sends the provided note URL and limit to a remote API and later stores the returned data locally, but does not prominently warn users that data is transmitted off-host and persisted. In a skill ecosystem, that omission can undermine informed consent and increase privacy/compliance risk, especially because returned results may include substantial public content and comments.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The CLI persists the full result set to a local JSON file using a filename derived from the target URL, but the user-facing help and runtime messaging do not clearly disclose that data will be stored on disk. This is risky because scraped profile data and metadata may remain on shared systems longer than expected, creating unnecessary retention and secondary disclosure risk.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The program silently writes search results to a local file without user-facing consent or warning, which is risky because search terms and collected public-content data may still be sensitive in aggregate. The skill context makes this more concerning because it is framed as a search/insight tool, so users may reasonably expect transient processing rather than durable storage.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:16