Security audit

小红书笔记洞察

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed Xiaohongshu public-data CLI skill that uses a third-party API and saves results locally, with privacy and credential-handling caveats but no hidden or destructive behavior found.

Install only if you are comfortable sending Xiaohongshu keywords, note URLs, profile URLs, requested limits, and a GUAIKEI_API_TOKEN to guaikei.com. Expect successful results to be saved locally under logs, and avoid using it for private, login-required, sensitive, or unclear monitoring tasks.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (20)

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The README documents capabilities such as competitor monitoring, KOL screening, and comment analysis that materially exceed the manifest’s stated scope of keyword-based public note insights. Scope drift like this is dangerous because users, reviewers, and downstream agents may trust the narrower manifest while invoking broader data-collection behaviors not clearly declared or consented to.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The usage examples explicitly show commands for note detail lookup, profile post monitoring, and comment retrieval, which are outside the manifest’s narrower keyword-note-insights description. Concrete examples that exceed declared scope are especially risky because they operationalize undeclared functionality and can mislead users or automated systems into permitting broader collection than intended.

Intent-Code Divergence

Low

Confidence: 78% confidence
Finding: The README reassures users that the tool only accesses non-private public data, but elsewhere it advertises comment-detail retrieval and profile monitoring beyond the manifest’s narrower framing. While this is not direct evidence of private-data access, the inconsistent disclosures create a trust and transparency problem that can cause users to underestimate the breadth of data collection.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The changelog documents capabilities beyond the declared skill metadata, including comment retrieval, note details, and creator monitoring. This creates a scope-mismatch risk: downstream agents or reviewers may rely on the narrow description while the skill actually exposes broader data collection and analysis functions, which can lead to unauthorized use, privacy/compliance issues, or bypass of expected approval boundaries.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The changelog claims support for comment sentiment analysis, which exceeds the stated purpose of searching public notes and returning engagement metrics. Undisclosed analytical features can materially change the data sensitivity and policy posture of the skill, increasing the chance of misuse, overcollection, or operation outside user and platform expectations.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The documentation materially expands the skill from the manifest-described keyword-search function into four separate capabilities, creating scope drift between what users/reviewers expect and what the skill instructs an agent to do. This is dangerous because hidden or undocumented capability expansion can cause over-collection of data, unintended execution paths, and weakened trust boundaries during tool use.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The document instructs the agent to monitor blogger profiles and retrieve recent posts, which goes beyond the stated keyword-search purpose and enables targeted tracking of specific accounts. In context, this increases privacy and surveillance risk because the skill can be used for persistent competitor or individual monitoring without that expanded capability being clearly declared in the manifest.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The documentation adds note-detail retrieval and comment harvesting outside the manifest's search-focused scope, allowing collection of more granular content and user-generated responses than users might expect. This is risky because comment extraction can materially increase data exposure and enable profiling, sentiment mining, or bulk collection under a narrower declared purpose.

Description-Behavior Mismatch

Medium

Confidence: 85% confidence
Finding: The file implements note-detail and comment retrieval endpoints, which goes beyond the declared skill scope of keyword-based public note search and ranking. This creates a scope mismatch that can expose more granular content and user interaction data than users or reviewers would expect, increasing privacy, compliance, and abuse risk even if the data is nominally public.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: This module implements blogger-profile and published-post retrieval APIs, which exceeds the declared skill scope of keyword-based public note search. That mismatch creates an undeclared capability surface: users or downstream agents may invoke author-level collection features that were not disclosed, reviewed, or consented to in the manifest, increasing privacy and policy risk even if the data is public.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The file documentation explicitly describes blogger details and published-note functionality, while the skill metadata says the skill is for keyword-based public note search and comparison. This kind of documentation/manifest inconsistency is dangerous because it signals hidden or unreviewed behavior, making it easier for a skill to expose data-access features beyond what operators and users expect.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: The CLI schema requires a blogger profile URL and a post limit, which materially conflicts with the skill manifest claiming keyword-based public note search and trend/insight analysis. This kind of scope mismatch is dangerous because an agent or user may invoke the skill expecting broad keyword research, while the code instead targets a specific account, causing unintended collection of account-specific data and violating least-surprise and consent expectations.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The help text explicitly instructs users to supply a blogger homepage URL and frames the workflow as profile post retrieval, reinforcing the mismatch with the declared keyword-insights skill purpose. In an agent ecosystem, misleading UX/documentation can cause misuse, overcollection, or routing of user requests to a tool with different access patterns than expected.

Description-Behavior Mismatch

Low

Confidence: 92% confidence
Finding: The CLI writes the full search output, including the user's keyword and returned results, to a local JSON file without any indication that persistence is part of the skill's behavior. This creates unnecessary local data retention and can expose potentially sensitive research queries or harvested content to other local users, backups, or later misuse.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The trigger guidance is intentionally broad enough to activate on generic requests like '最近什么火' or '帮我找热门内容' when the user does not explicitly name Xiaohongshu. This can cause over-collection or unintended third-party data exfiltration to the external API, because ambiguous social-media research requests may be routed to this skill without clear user consent for platform selection.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: This GET request includes the API token in query parameters, which is a real security weakness because query strings are commonly logged by servers, proxies, gateways, browser tooling, and monitoring systems. If those logs are exposed or retained broadly, the token can be recovered and reused to call the upstream API, especially in a skill that brokers access to third-party content retrieval.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The CLI persists full comment task results to a local JSON file via log.taskWrite without any explicit warning, opt-in, or apparent minimization. If the returned comments contain personal data, usernames, or other sensitive content, this creates unnecessary local data retention and increases exposure to accidental disclosure through shared workstations, backups, or log collection.

Missing User Warnings

Medium

Confidence: 69% confidence
Finding: The CLI reads `GUAIKEI_API_TOKEN` and sends user-supplied URLs and limits to a remote service without any explicit runtime disclosure or consent mechanism about outbound transmission. In an agent skill context, this can cause users or operators to unintentionally expose queried targets and use stored credentials in ways not clearly surfaced at the moment of execution.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The CLI writes the full result set to a local JSON file automatically, without clearly telling the user in advance. Persisting scraped profile data to disk can expose collected content and metadata to other local users, backups, or downstream tools, especially in shared or automated environments where users may assume the tool is output-only.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: Search results are silently persisted to disk via `log.taskWrite(...)` with no user-facing warning or consent flow in this file. Hidden storage increases privacy risk because users may believe the tool only prints results, while in reality it also creates durable local records of queries and scraped content.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:16