guaikei-xhs-note-data

• Outcome: Review
• Latest audit: Aug 12, 2026 · 9:38 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed Xiaohongshu public-data lookup tool that uses a third-party API and saves results locally, with no evidence of hidden mutation, private-account access, or destructive behavior.

Install only if you are comfortable sending Xiaohongshu keywords, note/profile URLs, limits, and your GUAIKEI API token to guaikei.com. Treat the generated logs/ directory as retained research data and delete it when no longer needed, especially when URLs contain xsec_token parameters or comments/content are business-sensitive.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence
• Finding: The skill's stated purpose is narrower than its actual operational scope: it can search content broadly, pull creator posts, fetch comments/details, and send data to a third-party service using an API token. This mismatch can mislead users and orchestrators into invoking broader data collection and local data retention behaviors than expected, increasing privacy, compliance, and data-exfiltration risk.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The README advertises capabilities well beyond the declared skill purpose, including broad data mining, competitor monitoring, trend prediction, and general marketing intelligence. This scope expansion is dangerous because it can mislead users and orchestrators into invoking the skill for data collection workflows that were not reviewed or authorized under the manifest, increasing the chance of policy bypass and unintended scraping behavior.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The documentation claims comment-detail retrieval and analysis of comment content/sentiment-like workflows that exceed the stated purpose of evaluating public engagement quality for KOL screening. In context, this broadens the skill into content-level surveillance and user-comment analysis, which can drive collection of additional public user data beyond the narrow approved use case.

Context-Inappropriate Capability

Low

• Confidence: 83% confidence
• Finding: Automatically saving all task results to logs creates unnecessary data retention for a skill whose approved purpose is narrow analytics. Even if the data is public, persistent storage of URLs, keywords, comments, and analysis outputs increases exposure to accidental disclosure, over-collection, and use beyond the original request.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The options document materially expands the skill from engagement-quality checks into broad keyword search, trend research, competitor analysis, and account monitoring. This scope drift is dangerous because an agent may invoke capabilities the user and platform did not expect from the manifest, weakening least-privilege guarantees and making policy review or consent boundaries inaccurate.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The documented keyword-search and trend-research functions go beyond checking the real engagement of a specific creator or note. In an agent setting, this can cause unauthorized or unexpected data gathering and task expansion, especially if orchestration logic trusts the manifest to represent the full behavioral surface of the skill.

Context-Inappropriate Capability

Low

• Confidence: 88% confidence
• Finding: Competitor-analysis and account-monitoring workflows extend the skill beyond the declared purpose of assessing engagement authenticity for a creator or note. While not inherently malicious, this mismatch increases the chance of over-collection and policy bypass because reviewers and users may approve a narrower skill than the one actually documented for use.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: The CLI persists fetched note-detail results to a local file even though the skill is described primarily as read-only analytics. Local persistence creates an extra data-retention surface: scraped note metadata and comments may remain on disk longer than the user expects, be readable by other local users/processes, or be unintentionally exfiltrated via backups and logs. In this skill context, the behavior is more concerning because the description does not clearly disclose disk writes, so users may assume results are only printed to stdout.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The CLI writes fetched results to a local JSON file even though the skill is described as read-only analytics. Persisting retrieved data increases data-retention risk, can leak user queries and scraped results to other local users/processes, and creates an unnecessary storage side effect beyond the user's apparent request. In this context, the data is public Xiaohongshu content, so the sensitivity is limited, but request URLs and analysis outputs may still contain tokens, identifiers, or business-sensitive research targets.

Vague Triggers

Medium

• Confidence: 80% confidence
• Finding: The trigger rules are broad enough to activate the skill for loosely related requests about understanding a Xiaohongshu creator, even when the user did not clearly ask for external data retrieval. Over-broad activation can cause unnecessary transmission of user-supplied URLs/queries to a third-party API and surprise users with unintended data collection or off-platform processing.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The script sends the user-provided note URL and comment limit to remote APIs to create and fetch a detail task, but the interface does not prominently warn users that their input will be transmitted off-host. For a CLI handling external content and potentially account-linked tokens, lack of clear disclosure can cause privacy and data-handling surprises, especially where users may expect local-only analysis. In this skill context, remote access is functionally necessary, which reduces suspicion of maliciousness, but undisclosed network transmission is still a legitimate security/privacy issue.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The script writes fetched detail results to a local JSON log file without clearly warning the user in the help text or skill description. This can expose collected note and comment data to unintended local access, persistence in backup systems, or later misuse, especially if users assume the tool only displays transient results. The risk is amplified by the mismatch between the read-only analytics framing and the undisclosed storage side effect.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The CLI persists full search output to a local JSON file without explicit user notice or an opt-in control. Even if the data is nominally public, saved search terms and result sets can create unintended local data retention, leak operational context, and expose potentially sensitive research activity to other local users or later processes.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:16