Security audit

guaikei·小红书笔记搜索与详情

Security checks across malware telemetry and agentic risk

Overview

This skill appears to do what it says: query public Xiaohongshu data through guaikei.com and save the returned results locally.

Before installing, be comfortable sending Xiaohongshu keywords, full note/profile links, and the GUAIKEI_API_TOKEN to guaikei.com. Treat saved logs as potentially sensitive business or personal-data records, delete them when no longer needed, and avoid passing private, login-only, or session-specific links.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 84% confidence
Finding: The top-level description narrows the skill to blogger-publication monitoring, but the workflow also supports broad keyword search, standalone note/comment extraction, and references local logging behavior not disclosed in the primary description. This mismatch can mislead users about what data is collected, how broadly the skill can be used, and whether outputs may be retained locally or sent to third parties.

Description-Behavior Mismatch

Low

Confidence: 82% confidence
Finding: The script writes full search results to a local JSON log file, creating data retention beyond the user-visible search operation. Even if the data is public, persisted logs can expose searched topics, collected content, and usage history to other local users, backup systems, or later compromise.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The examples instruct users to pass full Xiaohongshu URLs containing xsec_token into commands backed by a third-party API, but the warning about external transmission is only buried later in the compliance section and not tied to the examples themselves. Tokens and query parameters may carry sensitive access context or tracking data, so forwarding them without clear up-front notice creates an avoidable data exposure risk.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The README states that all task results are automatically saved to the logs/ directory, but it does not warn users about local data persistence, retention, or the possibility that scraped public content, URLs, comments, and analysis outputs may contain sensitive business intelligence or personal data. In a competitor-monitoring and comment-analysis tool, silent persistence increases the risk of unintended disclosure through shared machines, backups, source-control commits, or insecure file handling.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The CLI silently persists detailed request and result data, including note details/comments and request metadata, to a local file without explicit user notice or consent at execution time. In shared environments, CI runners, or analyst workstations, this can create unintended data retention and secondary exposure through filesystem access, backups, or log collection.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: Search results are silently persisted to disk without explicit runtime disclosure or consent in the execution flow. This can surprise users and create privacy and operational risk because queries and returned content may remain on disk longer than expected and be accessible to unauthorized local processes or users.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:17