Security audit

guaikei-xhs-note-search

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Xiaohongshu public-data lookup tool that uses a third-party API token and saves results locally, with no evidence of hidden exfiltration, account mutation, or destructive behavior.

Install only if you are comfortable sending Xiaohongshu keywords, note/profile URLs, requested limits, and your GUAIKEI_API_TOKEN to guaikei.com. Treat saved logs as potentially sensitive business research or public personal-content data, and delete the logs directory when you no longer need retained results.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill requires an environment variable (`GUAIKEI_API_TOKEN`) and clearly depends on external API access, but it does not declare explicit permissions beyond metadata requirements. This creates a transparency and governance gap: runners or users may not understand that secrets are being consumed and data is being sent to a third-party service, increasing the risk of unintended secret exposure or unauthorized external data transfer.

Description-Behavior Mismatch

Medium

Confidence: 87% confidence
Finding: The CLI writes fetched creator-note results to local storage as a side effect, but the user-facing description emphasizes search/view of public data rather than persistent collection. This creates a privacy and data-handling risk because scraped results may be retained longer than expected, exposed to other local users/processes, or reused beyond the immediate user request.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The CLI persists full search output to a local JSON file after completing the request, even though the advertised functionality is search/view/grab rather than local retention. Search results and user-supplied keywords may contain sensitive research interests, competitive intelligence targets, or other operational data, and silently storing them increases exposure to other local users, backups, or later compromise.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The document instructs users to configure an API token and retrieve content from an external platform, but it does not clearly warn that user-supplied keywords, URLs, note content, comments, and account targets may be transmitted to third-party services. This can lead to unintentional disclosure of sensitive research targets, personal data in comments, or operational metadata, especially when users paste private or semi-sensitive links into the tool.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The CLI writes the full result payload, including searched note URL and returned content/comments, to a local JSON file automatically. In this skill context, harvested social-media data may contain personal or sensitive content, and silently persisting it increases the risk of unintended retention, disclosure to other local users/processes, or later exfiltration.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The code writes search results to disk without any explicit user-facing warning, consent, or prior disclosure at runtime. This creates a privacy and data-handling risk because users may reasonably expect a search CLI to print results only to stdout, not create durable local artifacts containing queries and returned content.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.