Security audit

guaikei·小红书笔记详情

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent public Xiaohongshu data lookup tool, with the main caution that it sends queries to a third-party API and saves full results locally.

Install only if you are comfortable sending Xiaohongshu keywords, URLs, and the GUAIKEI_API_TOKEN to guaikei.com. Treat the generated logs as potentially sensitive, especially for competitor, KOL, or comment analysis, and delete or protect them when no longer needed.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The package metadata advertises broad analytics, competitor monitoring, KOL screening, user profiling, and growth/marketing capabilities, which materially exceeds the stated skill scope of only handling public Xiaohongshu data retrieval. This mismatch can cause an orchestrator or reviewer to over-trust or over-invoke the skill for profiling, surveillance, or cross-purpose marketing tasks that were not intended by the manifest, increasing the chance of privacy-invasive or policy-violating use.

Description-Behavior Mismatch

Low

Confidence: 82% confidence
Finding: The README states that all task results are automatically saved to a local logs/ directory, which expands the skill's behavior from transient read-only public-data processing into persistent storage. Even if the source data is public, saved outputs may include queried URLs, keywords, comment text, account identifiers, and analysis results, creating a residual data-retention surface not clearly reflected in the skill description.

Vague Triggers

Medium

Confidence: 81% confidence
Finding: The description is marketing-oriented and broad, but it does not specify clear trigger boundaries such as 'only for public Xiaohongshu data' or 'not for cross-platform or authenticated data.' In agent environments, vague invocation metadata can lead to the skill being selected for tasks outside its safe operating scope, which raises the risk of misuse and unintended data handling.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: Automatically saving all task results to logs without any warning about sensitivity can expose collected content and user query context to other local users, backups, or downstream tooling. In this skill's context, outputs may contain public-but-sensitive aggregations such as monitored competitor datasets, comment corpora, KOL profiling results, and tokenized URLs, so silent retention increases privacy and confidentiality risk beyond the immediate task execution.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The CLI writes the full comment task output to a predictable local JSON file, and that output may contain scraped public comments, metadata, and possibly identifiers tied to a specific note URL. Even if the source data is public, silently persisting collected results to disk creates an unnecessary data retention and disclosure risk, especially on shared systems or when logs/workspaces are later uploaded or synced.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:15