Security audit

guaikei-xhs-market-research

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Xiaohongshu public-data research tool that uses guaikei.com and saves fetched results locally, with no hidden destructive or credential-stealing behavior found.

Install only if you are comfortable sending Xiaohongshu keywords or links and your GUAIKEI_API_TOKEN to guaikei.com. Treat returned comments and public post data as retained local records because successful runs save JSON files under logs; use smaller limits unless bulk collection is truly needed.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (20)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 88% confidence
Finding: The manifest and top-level description frame the skill narrowly as creator-post retrieval, but the body documents a broader data-access toolkit including keyword search, note detail retrieval, and comment collection. This mismatch can cause users or orchestrators to invoke the skill under a narrower trust assumption than its real behavior, leading to unintended data disclosure to the third-party API or overbroad tool use.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The package metadata advertises capabilities such as data mining, trend monitoring, competitor analysis, KOL screening, traffic growth, and user profiling that are broader than the stated skill purpose of listing a blogger’s public posts. This mismatch can enable capability creep, mislead reviewers and users about what the skill may collect or infer, and increase the chance that the skill is invoked for higher-risk analytics outside its declared scope.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The README advertises substantially broader capabilities—trend prediction, competitor monitoring, KOL screening, keyword search, and comment analysis—than the skill metadata, which limits the skill to retrieving a blogger’s public post list. This mismatch can mislead users and reviewers about the actual operational scope, increasing the risk of unauthorized data collection, over-privileged use, or hidden functionality being normalized under incomplete metadata.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The README explicitly documents comment-analysis functionality, which is outside the declared use case of obtaining a blogger’s public work list. Even if the data is public, expanding into comment collection changes the data sensitivity and processing scope, potentially exposing user-generated content and enabling broader surveillance or profiling than users and platform reviewers expect.

Description-Behavior Mismatch

Low

Confidence: 84% confidence
Finding: The statement that all task results are automatically saved to a logs directory indicates persistent local storage beyond a simple read-only analysis description. Automatic retention of fetched results can increase exposure of scraped public data, URLs, tokens embedded in links, or derived analysis outputs if storage is not clearly disclosed, minimized, and protected.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The changelog states the skill can fetch Xiaohongshu comment information, which expands capability beyond the declared scope of only listing a creator’s public posts and evaluating single-note performance. This kind of scope drift is dangerous because downstream agents or users may rely on the narrower metadata and unintentionally invoke undocumented data collection features, weakening consent, review, and policy enforcement boundaries.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The changelog describes keyword search functionality that does not match the current positioning of the skill as focused on creator post research from a homepage link. Capability mismatch is risky because it can mask a broader data acquisition surface than expected, causing policy bypass, incorrect tool selection, or use in scenarios that were supposed to be excluded.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The changelog claims support for comment sentiment analysis, which materially exceeds the stated function of viewing public works lists and note-level performance. Sentiment analysis on comments may introduce additional processing of user-generated content and profiling-like behavior that has different compliance and privacy implications than simple content listing.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The documentation materially expands the skill from the manifest’s stated scope of fetching a blogger’s public works into broader search, note-detail, comment, and competitor-analysis capabilities. This kind of scope drift is dangerous because it can cause the agent to invoke undeclared data-collection behaviors users and platform reviewers did not consent to expect, increasing the chance of oversharing, policy bypass, or misuse of adjacent capabilities.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The file documents comment-focused analysis even though the skill is described as being for viewing a blogger’s public works and single-post performance, not comment harvesting or sentiment analysis. Expanding into comment retrieval and analysis increases collection of third-party user content and can expose the agent to privacy, moderation, and unauthorized-purpose risks beyond the declared use case.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: This file adds a comment-collection capability for Xiaohongshu notes, which exceeds the declared skill scope of only researching a blogger’s public work list and post performance. Scope expansion is dangerous because it enables collection of additional user-generated content and potentially personal data without matching user expectations, consent language, or manifest disclosure.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The file implements generic keyword-based note search, while the stated skill scope is limited to retrieving a creator's public work list from a homepage link. This scope expansion increases data access and collection capability beyond user expectations and manifest constraints, which can enable unintended surveillance or scraping workflows even if the code itself is not directly exploitable.

Description-Behavior Mismatch

Low

Confidence: 84% confidence
Finding: The CLI writes the full comment retrieval output to a local JSON file without any explicit consent, retention control, or masking. Persisting scraped or retrieved comment data increases exposure through unintended local access, backup propagation, or later reuse, especially because the manifest presents the skill as read-oriented and does not warn about storage behavior.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The CLI explicitly accepts a comment retrieval limit and later creates a detail task that fetches note details and comments, which exceeds the declared skill scope of only retrieving a blogger's public work list. This creates a scope-mismatch/data-minimization issue: an agent or user can use this skill to collect per-note engagement data and comments that were not justified by the manifest, increasing privacy and compliance risk.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The code exposes a '--limit' parameter up to 10,000 comments, enabling large-scale collection of comment data despite the skill being described only for public work-list analysis. Even if the source content is public, this materially expands collection capability and can facilitate scraping, profiling, or bulk harvesting beyond the principle of least privilege for the stated use case.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The file exposes a generic keyword-based Xiaohongshu search CLI, while the skill metadata says the skill is for blogger homepage/public works listing and explicitly says it is not for broader analytics contexts. This capability expansion matters because it enables discovery and collection of arbitrary public content outside the declared scope, increasing privacy, compliance, and misuse risk and defeating policy controls that may rely on the manifest description.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The argument schema is designed for broad discovery search by keyword, type, sort, time, and large limits, which exceeds the stated blogger-analysis-only purpose. In the skill context, this makes the mismatch more dangerous because users and security reviewers may assume narrow creator-page analysis while the code actually supports open-ended content enumeration.

Vague Triggers

Medium

Confidence: 77% confidence
Finding: The trigger condition is broad enough that simply providing a homepage link and expressing a desire to view works may auto-route into external data retrieval. In an agent setting, overly permissive invocation criteria increase the risk of unintended third-party data transfer, especially when links or user context are supplied without a clear, informed request to use this specific external integration.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The tool stores comment results to disk and only reports generic success, so users may reasonably believe the action was transient when it actually created a durable local record. Silent persistence is dangerous because it undermines user expectations, can violate least-surprise/privacy principles, and may expose collected comments to other local users, malware, or downstream tooling.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The code persists full search results to a local JSON file automatically after execution, without an explicit runtime warning, consent, or opt-in. Even if the content is public, automatic local retention increases data handling risk by creating artifacts that may contain searched topics, timestamps, and retrieved content metadata, which can be exfiltrated, misused, or retained longer than intended.

VirusTotal

57/57 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:16