guaikei-xhs-note-finder

• Outcome: Pass
• Latest audit: Aug 12, 2026 · 2:43 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed public Xiaohongshu research tool, with the main caution that it automatically saves fetched results locally.

Install only if you are comfortable sending Xiaohongshu keywords or public links to the guaikei.com API with your GUAIKEI_API_TOKEN, and treat the generated logs directory as potentially sensitive because it stores full fetched result JSON until you delete it.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence
• Finding: The public description says the skill is for fetching a blogger's public post list plus note details/comments, but the document also instructs keyword-wide search and mentions automatic log archival, which expands collection scope and local data retention beyond the declared behavior. This matters because users and reviewers may authorize the skill under a narrower understanding, while the actual behavior can collect broader competitive intelligence data and persist potentially sensitive business research artifacts to disk.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The CLI writes the full fetched result set, including note details and comments, to a local JSON file by default. Even if the target content is public, automatic persistence expands the data exposure surface by creating a durable local copy that may be accessed by other users, backup systems, or later processes without the operator realizing it.

Description-Behavior Mismatch

Low

• Confidence: 78% confidence
• Finding: The CLI writes full search results to a local JSON file without any visible consent or retention control. Even if the target data is public, stored result sets can accumulate sensitive operational context, search history, or large datasets that exceed user expectations for a read-only analysis tool and create avoidable local data exposure risk.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The README explicitly states that all task results are automatically saved to the `logs/` directory, but it does not warn users that fetched public-profile, note-detail, and comment data will be persisted locally. In a data-scraping/competitor-monitoring skill, silent retention increases the risk of unintended data accumulation, over-collection, and later disclosure through backups, shared workspaces, or source-control mistakes.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This file saves fetched detail results to disk without any user-facing notice at the point of execution. Silent persistence is risky because operators may assume the tool only prints results, while it actually leaves recoverable artifacts containing scraped content and metadata on the host.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: Persisting search results locally without a user-facing warning or confirmation can surprise users and create unintended data retention on the host system. In the context of competitor monitoring and content analysis, this may capture research targets, query terms, and retrieved datasets that could be exposed to other local users, backups, or later compromise.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.