Security audit

guaikei·小红书挑热门的

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Xiaohongshu public-data retrieval tool, but users should understand that it sends queries and links to a third-party API and saves returned results locally.

Install only if you are comfortable sending Xiaohongshu keywords, note links, profile links, and the GUAIKEI_API_TOKEN to guaikei.com. Treat returned comments/profile data as public but still potentially personal, and periodically delete the generated logs if you do not want local retention.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (21)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 86% confidence
Finding: The published description presents the skill as a narrow 'pick hot/recent posts' capability, but the body instructs the agent to also fetch note details, comments, and creator post histories, with broader sort and time-range options. This mismatch can cause users or orchestrators to invoke the skill under weaker consent assumptions than the actual data collection scope, increasing the risk of over-collection and unintended third-party data disclosure to the external API.

Description-Behavior Mismatch

Medium

Confidence: 79% confidence
Finding: The exposed CLI entry points include detail, post, and comment operations that go beyond the declared read-only hot-topic retrieval use case. In an agent-skill context, undocumented write-capable or expanded data-access functions increase the risk of unintended actions, privilege overreach, or abuse if the surrounding platform assumes the skill is limited to passive trend inspection.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The README advertises a much broader data-mining tool than the manifest describes, including competitor monitoring, KOL screening, and trend prediction. This scope mismatch can cause an agent or user to invoke the skill for undeclared behaviors, undermining least-privilege expectations and trust boundaries around what the skill is supposed to do.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The documentation explicitly claims capabilities such as competitor monitoring, KOL screening, and comment analysis that exceed the skill’s stated intent. In an agent ecosystem, this is dangerous because it invites use outside approved scope and may mask unreviewed data access patterns or future tool expansion behind misleading documentation.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The usage examples and scenarios instruct users to perform note detail lookup, account monitoring, and comment analysis beyond the manifest’s narrow hotspot-tracking purpose. Concrete examples are especially risky because they operationalize out-of-scope behavior and make accidental or unauthorized invocation more likely.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The documentation advertises four operational capabilities even though the skill metadata says it is for recent hot-trend keyword retrieval only. This scope expansion increases the chance an agent will invoke unrelated data-collection functions such as note detail, comments, or creator monitoring without the user's informed intent, creating capability confusion and over-collection risk.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The keyword-search section expands from 'latest recent movement' into broader research modes such as popularity ranking, interaction-based sorting, and trend tracking over time. That mismatch can cause the agent to perform a more expansive analysis than the user or platform policy expects, undermining least-privilege behavior for the declared skill.

Description-Behavior Mismatch

Medium

Confidence: 98% confidence
Finding: The file documents creator monitoring and competitive-account tracking, which are materially different from keyword-based hotspot discovery. In an agent environment, this hidden broadening of surveillance-oriented functionality can enable collection on specific accounts beyond the user's expected request surface.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The documentation includes note-detail retrieval and comment-analysis flows that exceed the manifest's narrow trend-search purpose. This creates a real risk of unreviewed access patterns and secondary processing of user-generated content under a misleading skill identity.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The module implements blogger-profile and published-post retrieval APIs, while the skill manifest claims keyword-based recent hot-note trend monitoring. This capability mismatch is security-relevant because users and downstream systems may grant the skill broader trust or data access based on a false description, causing unintended collection or processing of creator-profile data. In this context, the discrepancy makes the skill more dangerous because it suggests the skill may operate on a different target scope than the user expects.

Intent-Code Divergence

Medium

Confidence: 89% confidence
Finding: The file header and function documentation explicitly describe blogger-detail and published-note collection, contradicting the declared purpose of tracking recent keyword hotspots. Misleading internal documentation can conceal scope creep and make reviewers miss that the skill is handling different data and actions than advertised. Because this is a social-content monitoring skill, such hidden scope changes increase the risk of privacy-impacting misuse and deceptive behavior.

Context-Inappropriate Capability

Low

Confidence: 89% confidence
Finding: The CLI persistently writes fetched note-detail results to a local JSON file using a filename derived from the target URL, without any opt-in, retention control, or redaction. If the fetched details include comments, usernames, or other sensitive content, this creates an unnecessary at-rest data exposure risk and can leak information to other local users, backup systems, or logs.

Vague Triggers

Medium

Confidence: 80% confidence
Finding: The description uses broad activation criteria such as handling any request about 'recent activity' even when the user did not mention trends, which makes accidental invocation more likely. Overbroad routing can send user-provided keywords or links to a third-party data service without sufficiently specific user intent, creating privacy and data-minimization concerns.

Vague Triggers

Medium

Confidence: 78% confidence
Finding: The example trigger phrases are everyday, high-level requests that could match many normal conversations, but they do not define boundaries or exclusions. In an agentic environment, this increases the chance that the skill is selected too aggressively and external calls are made when a simpler local answer or clarification would have been more appropriate.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The invocation guidance is broad and lacks precise trigger boundaries, exclusions, and allowed intents. That ambiguity can cause over-invocation by an agent, including for competitor surveillance or comment scraping when the manifest only authorizes recent keyword trend monitoring.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The README states that all task results are automatically saved to the logs directory but does not warn that searched keywords, queried links, and analysis outputs may be stored locally. This creates a privacy and data-retention risk, especially if logs contain sensitive research topics, competitor targets, or user-provided URLs and are accessible to other local users or later exfiltrated.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The examples encourage pulling and analyzing note comments without any warning about privacy, retention, or responsible handling of user-generated content. Even if comments are public, analyzing them at scale can expose personal data, sensitive opinions, or profiling risks, especially when an agent automates collection.

Missing User Warnings

Low

Confidence: 84% confidence
Finding: The document tells users to configure an API token but provides no security guidance on storing, scoping, or avoiding disclosure of the credential. In agent tooling, omission of credential-handling instructions can lead to tokens being hardcoded, logged, or exposed in prompts and transcripts.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The CLI persists fetched comment results to a local JSON file automatically, but the user is not clearly warned at execution time that potentially sensitive or personal data from comments will be stored on disk. This can increase exposure through unintended retention, local disclosure to other users/processes, backups, or later reuse beyond the original task.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill saves fetched detail results to a local JSON file without any user-facing warning or confirmation, so users may unknowingly persist third-party content and metadata on disk. In the context of a trend-monitoring skill, silent storage is less justified and increases privacy/compliance risk if the output contains comment content or identifiable data.

Missing User Warnings

Low

Confidence: 82% confidence
Finding: The tool persists full search output to a local file derived from user input without any explicit consent or visibility at the write site. This can unintentionally retain potentially sensitive query history or scraped content on disk, increasing exposure on shared hosts, developer workstations, or environments with lax file permissions.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:16