Security audit
Security checks for vulnerabilities and agentic risk
The skill appears to perform the stated Xiaohongshu public-data tasks, but it needs review because it sends tokens and target URLs to a third-party API in URL query strings and saves full results locally by default.
Review this skill before installing. It is not showing deception or destructive behavior, but you should only use it if you are comfortable sending Xiaohongshu targets and your Guaikei API token to www.guaikei.com, and you should regularly delete or protect the generated logs/ directory because it may contain research targets, comments, and token-bearing URLs.
src/utils/request.js:76API Credentials and Sensitive Request Parameters Exposed in URL Query Strings
src/utils/log.js:5Successful Retrieval Results Are Automatically Persisted Without Explicit User Opt-In
声明的核心用途是围绕“博主主页/竞品账号”抓取公开作品列表，并结合详情评论做整体内容表现分析；这通常需要账号作品列表采集、可能还要多篇笔记聚合。给出的代码块只包含 detail.js，功能是调用 /api/xiaohongshu/detail/url 和 /api/xiaohongshu/detail/info 来创建并获取单条笔记的详情与评论结果，输入也是‘笔记链接’而非‘博主主页链接’。虽然它与声明中提到的‘配合笔记详情与评论’部分有关，且访问的是公开小红书数据，并未涉及登录态或私密数据，但就该代码块本身而言，主要行为与声明的主要目的相比明显更窄，缺少作品列表抓取和账号级分析能力，因此构成描述与实际行为不匹配。
声明的核心用途是针对指定博主主页做公开作品列表抓取，并配合笔记详情与评论来分析账号表现；而实际代码仅调用 note-search 接口创建/查询“关键词搜索”任务，处理返回结果并补充笔记/用户 URL。代码没有体现按博主主页或账号ID抓取作品列表，也没有抓取笔记详情、评论，或执行竞品账号分析逻辑。因此其主要行为与声明用途存在实质偏差。虽然两者都与小红书公开内容有关，且未涉及登录态/私密数据，但代码更像通用内容搜索模块，不是声明中的博主竞品分析抓取模块。
声明描述的是一个面向小红书公开数据抓取与内容分析的技能，核心能力应包括访问小红书页面/API、提取作品列表/笔记/评论，并组织分析结果。但代码片段实际仅是与业务无关的基础工具模块，用于解析命令行参数和生成帮助信息。它没有表现出任何小红书相关的数据访问、抓取、解析、分析或监控行为。因此该代码与声明的主要用途存在明显不一致。这不属于正常的“支持性实现细节”，因为从提供的代码片段来看，其功能完全是通用 CLI 工具，而非所声明技能能力的直接实现。
声明描述的是一个面向小红书博主公开内容的抓取与分析技能，但提供的代码片段只是在管理/校验API TOKEN，并引导用户通过微信获取私有TOKEN。这不是单纯的底层辅助细节能支撑声明功能的情况，因为当前片段完全没有体现任何与小红书页面访问、作品列表抓取、笔记详情获取、评论读取或内容分析相关的行为。代码的实际用途与声明的核心目的存在明显偏离，因此应判定为描述与行为不一致。
声明的核心能力是抓取和分析小红书公开内容数据，但代码片段实际只是一个本地日志写入模块，没有任何网络请求、小红书页面抓取、作品/笔记/评论解析、账号分析或竞品监控逻辑。虽然日志记录可作为辅助实现细节，但当前提供的代码片段本身的实际行为与声明用途明显不一致，并展现了未在声明中体现的本地文件写入能力。
There is a clear mismatch between the declared description and the supplied code chunk. The description claims functionality for collecting and analyzing public Xiaohongshu posts, note details, and comments. However, the code does none of that: it imports fs and path, reads a local package.json file, parses it, and returns the package name. This is a local metadata utility, not a scraper or analytics implementation. Reading package metadata is not merely a supporting detail for the declared behavior in this chunk, because the chunk itself contains no observable logic related to the stated Xiaohongshu analysis purpose.
声明描述的是一个面向小红书博主竞品分析的数据抓取与分析技能，核心能力应包括根据博主主页链接获取公开作品、进一步获取笔记详情和评论，并据此分析内容表现。而当前代码仅是一个通用输入校验模块：检查关键词长度、特殊字符、是否包含 http 链接，清洗关键词字符集，并规范搜索参数取值。这更像是“关键词搜索”功能的辅助校验逻辑，且还显式拒绝 http 链接，与声明中“给了博主主页链接也适用”的触发方式相冲突。虽然这可能是整个技能中的一个支持性文件，但就该代码片段本身而言，其行为与声明的主要用途存在明显不一致。
声明描述的是一个面向“博主/竞品账号分析”的技能，核心能力应包括抓取博主公开作品列表，并结合多篇笔记信息做账号层面的节奏与表现分析。实际代码仅实现了 detail-cli，对输入的单个小红书笔记链接获取详情和评论，属于笔记级数据提取。虽然它访问的是公开小红书内容，也没有显示涉及私密数据或登录态，和声明中的部分子能力（笔记详情/评论）有关，但缺少声明中的主要能力：博主主页/作品列表抓取、账号级汇总分析，以及以主页链接为触发条件。因此这是明显的描述与行为不一致。
声明的核心能力是“面向单个博主账号的内容分析”，输入应偏向博主主页链接或账号标识，并需要汇总其作品、详情和评论数据。实际代码的核心功能则是“关键词搜索内容”，支持内容类型、排序、发布时间和数量等搜索过滤条件。虽然二者都与小红书公开内容有关，但主目的和操作对象明显不同：一个是账号/博主分析，另一个是关键词检索。代码中也没有任何与博主主页解析、账号作品枚举、详情抓取、评论抓取或节奏/风格/互动分析相关的实现。因此该描述不能准确代表这段代码的实际行为，属于实质性不匹配。
Referenced artifact was not completely inspected
- "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Referenced artifact was not completely inspected
- "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Referenced artifact was not completely inspected
- "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Referenced artifact was not completely inspected
- "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Referenced artifact was not completely inspected
- "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Referenced artifact was not completely inspected
- "拉这条笔记的评论做观点聚类: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Referenced artifact was not completely inspected
- "拉这条笔记的评论做观点聚类: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Referenced artifact was not completely inspected
- "拉这条笔记的评论做观点聚类: node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
The skill requires access to a sensitive environment variable (GUAIKEI_API_TOKEN) but does not declare any explicit tool scope or permission boundary. This creates an authorization gap where the runtime may expose secrets to a skill whose allowed capabilities are not narrowly documented or enforced, increasing the risk of token misuse or unintended propagation to external services.
The skill description encourages activation on broad user intent plus essentially any Xiaohongshu profile link, which can cause over-triggering and unnecessary external data retrieval. In an agent setting, overly broad invocation conditions increase the chance of collecting or transmitting third-party data without sufficient user specificity or need, especially since the skill sends requests to a third-party API service.
The README states that all task results are automatically saved to the logs/ directory, but it does not warn that those results may contain searched keywords, queried profile or note URLs, comment data, and derived analysis outputs. In this skill’s context, users may analyze competitor accounts or KOL activity, so persistent local storage can create unintended retention and secondary disclosure risks if logs are shared, backed up, or accessible to other users on the same system.
The function accepts an API token and sends it in the request parameters via postJson, which is a safety-relevant network operation involving credentials. While the code has technical docstrings and retry error logging, there is no user-facing warning, confirmation, or disclosure that the token will be sent to a remote API.
This function sends the user-provided note URL and API token over the network using getJson. Although the function is documented for developers, the file does not provide any user-facing warning that potentially sensitive user input and credentials are transmitted to an external endpoint.
The manifest describes a skill for analyzing a blogger account given a profile/homepage link, restoring posting rhythm and content performance via public works, note details, and comments. This file instead creates and retrieves generic keyword note-search tasks and returns search-result note/user URLs, which is a broader discovery capability than the declared account-centric scope.
This code emits all user-facing warning and guidance text in Chinese, including the recovery instructions for obtaining a token. Because the file provides no indication that the skill is China-specific or that users can opt into another language, it creates a natural-language locale policy violation under the rule for forced language without user choice.
This code serializes arbitrary request data to JSON and sends it over HTTPS via POST, and the GET helper also transmits query parameters over the network. There is no confirmation prompt, logging, comment, or docstring in this file disclosing that user or system data may be sent to a remote service.
Detected: suspicious.exposed_secret_literal