Security audit

guaikei·小红书采公开数据做增长

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Xiaohongshu public-data retrieval tool that uses a third-party API and saves results locally, with privacy and retention considerations but no hidden or destructive behavior found.

Install only if you are comfortable sending Xiaohongshu keywords, links, requested limits, and your GUAIKEI_API_TOKEN to guaikei.com, and with fetched results being saved locally under logs. Use it for public data only, avoid private/login-only content, and delete logs when they are no longer needed, especially on shared or synced machines.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (18)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 88% confidence
Finding: The top-level description frames the skill narrowly as retrieving a blogger's public post list, but the document also enables broader capabilities: keyword search, note-detail retrieval, and comment harvesting. This mismatch can cause users or orchestrators to invoke the skill under narrower trust assumptions than its real data-access scope, increasing the chance of unintended third-party data collection and disclosure to the external API.

Description-Behavior Mismatch

Medium

Confidence: 86% confidence
Finding: The manifest text limits expectations to blogger post-list retrieval, while the body documents several additional collection functions. Security-relevant scope understatement is dangerous because operators may approve or route the skill without realizing that user queries, note URLs, and comment-retrieval requests may be sent to a third-party service for broader scraping/collection actions.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The README advertises capabilities far beyond the manifest’s stated scope of retrieving a blogger’s public works list, including competitor monitoring, trend prediction, KOL screening, and comment analysis. This scope mismatch is dangerous because it can mislead operators, reviewers, and permission systems about what the skill is intended to do, increasing the risk of unauthorized data collection or use beyond user expectations.

Intent-Code Divergence

Medium

Confidence: 83% confidence
Finding: The documentation claims the tool only accesses public data and does not involve privacy data, while elsewhere promoting competitor monitoring, KOL screening, comment analysis, and trend surveillance. Even if the data is public, this framing can understate the privacy and compliance risks of aggregating and analyzing platform data at scale, which may mislead users into thinking there are no meaningful data-protection concerns.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The documentation defines a broader 'insight and competitor analysis' assistant with four capabilities, while the manifest says the skill is for listing a blogger’s public posts only. This scope mismatch can cause an orchestrator or downstream reviewer to authorize or invoke collection of keyword-search, note-detail, and comment data that the user did not intend, increasing the risk of over-collection and policy bypass.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: Keyword search over public content is materially broader than the declared function of viewing a specific blogger’s published works. In an agent setting, this expands the skill from targeted retrieval to general discovery and competitor intelligence gathering, which can enable unapproved data collection and misuse of the skill beyond least-privilege expectations.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: Note-detail and comment-retrieval flows exceed the stated purpose of listing a blogger’s public works and introduce access to per-post content and audience responses. That broader collection surface can expose more user-generated data than necessary for the declared task, making misuse and privacy-impacting overreach more likely.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: Standalone comment extraction is outside the declared blogger-post-listing purpose and is especially sensitive because it focuses directly on user-generated responses rather than publisher metadata. In context, this makes the skill more dangerous by enabling collection and analysis of commenter content under a narrower-looking manifest.

Description-Behavior Mismatch

High

Confidence: 94% confidence
Finding: This file implements creation and retrieval of Xiaohongshu comment-collection tasks, which materially exceeds the declared skill scope of fetching a creator's public post list. Expanding from post metadata into comment harvesting increases data collection sensitivity and creates a capability/manifest mismatch that can enable undisclosed scraping of third-party user content.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: Collecting note comments is not necessary to satisfy the stated use case of analyzing a creator's public work list, posting frequency, and which posts performed well. This unnecessary data access broadens privacy exposure and can be repurposed to profile commenters or gather content beyond what users would reasonably expect from the skill description.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The skill metadata says it is intended for public work-list analysis and explicitly says it is not for broader data collection, yet this module creates and fetches note-detail tasks with comment retrieval via a configurable `limit`. Collecting comments materially expands the data scope beyond the declared purpose and can expose user-generated content and engagement data that may not be necessary for the advertised function. In this context, the mismatch between declared scope and implemented capability increases privacy and compliance risk.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: This function creates a general keyword-based note search task, which expands the skill beyond its declared purpose of listing a specific creator's public works from a homepage link. That scope mismatch can enable broader content discovery and collection than users or platform reviewers would expect, increasing policy and data-use risk even though it does not directly expose secrets or perform code execution.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The result retrieval path returns arbitrary search results and constructs note and user profile URLs for any matched content, not just works belonging to a requested creator. In this skill's context, that materially broadens the accessible dataset and makes the mismatch more dangerous because the published description explicitly says it is for creator work listing via homepage links, not general discovery.

Description-Behavior Mismatch

High

Confidence: 93% confidence
Finding: The file performs general keyword-based content search and returns arbitrary search results, while the skill metadata says it should only retrieve a specified creator's public post list. This scope mismatch is security-relevant because it expands data access and behavior beyond the declared capability, undermining user and platform expectations and potentially enabling collection of broader public content than intended.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The markdown notes that data is mediated through a third-party API, but it does not clearly disclose that user-supplied links, keywords, and public-data lookup requests are transmitted off-platform to guaikei.com. This creates a transparency and privacy risk: users may believe the skill operates locally or first-party when their inputs are actually sent to an external service.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The README states that all task results are automatically saved to the logs directory, named with timestamps and keywords/links, without clearly warning that user queries, profile URLs, and fetched platform data will be persisted locally. This creates a real risk of unintended sensitive-data retention, local disclosure, or secondary use, especially on shared machines, synced folders, or developer environments with weak log hygiene.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The CLI writes fetched comment results to a local file automatically, without an explicit user-facing warning or opt-in at the point of execution. Persisting user-requested scraped content can increase privacy and data-retention risk, especially on shared systems, CI runners, or environments where working directories are monitored, backed up, or later accessed by other users.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The CLI sends a user-supplied URL to an external API, retrieves potentially sensitive returned content such as note details/comments, prints it to stdout, and persists it locally without any consent prompt, disclosure, or data-minimization controls. In this skill context, the data is nominally public, which lowers severity, but storing fetched content and metadata to local files can still create unintended retention, privacy, and operational exposure.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:16