guaikei-xhs-public-data-tool

• Outcome: Review
• Latest audit: Aug 12, 2026 · 3:34 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed Xiaohongshu public-data integration that sends user-provided keywords or links to guaikei.com and saves returned results locally.

Install only if you are comfortable sending Xiaohongshu keywords or links, including any URL query parameters, to guaikei.com using your GUAIKEI_API_TOKEN. Treat returned comments/profile data and the logs directory as retained local data, especially for business or competitive research.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The README presents a much broader capability set than the manifest’s stated purpose of routing and analyzing provided Xiaohongshu links. This creates a scope mismatch that can mislead users and integrators about what the skill is authorized to do, increasing the risk of over-collection, unexpected processing, or hidden functionality being normalized.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The documented keyword search, trend monitoring, and KOL/competitor analysis functions go beyond the manifest’s narrow link-analysis use case. In a security review, this kind of unjustified scope expansion is dangerous because it can mask surveillance-oriented or bulk collection behavior under a seemingly limited skill description.

Context-Inappropriate Capability

Low

• Confidence: 84% confidence
• Finding: Automatically saving all task results to local logs is broader than the manifest’s stated link-routing purpose and introduces undeclared retention of potentially sensitive scraped content. Even if the data is public, persistent storage increases exposure through later reuse, leakage, or unintended access on the host system.

Description-Behavior Mismatch

Medium

• Confidence: 84% confidence
• Finding: The file implements free-form keyword-based search task creation and retrieval, which exceeds the declared skill scope of routing and analyzing user-supplied Xiaohongshu links. This scope expansion can enable broader data collection or scraping behavior than users would reasonably expect from the manifest, increasing privacy and trust risks even if the code itself is straightforward.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: This file implements a keyword-based Xiaohongshu search CLI, but the declared skill purpose is limited to routing and analyzing user-provided Xiaohongshu links. That mismatch materially expands the skill’s capability beyond its manifest, which can bypass user and platform expectations, enable broader data access than disclosed, and indicate undeclared functionality.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The code loads an API token from the environment to perform a search capability that is not justified by the stated link-analysis scope. While reading environment secrets is normal in isolation, using them for undeclared functionality increases risk because it grants the skill authenticated external access beyond what users and reviewers were told to expect.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill sends user-provided links, keywords, and potentially embedded tracking parameters (such as `xsec_token` in example URLs) to a third-party API service, but the warning is buried late in the document rather than presented prominently before use. This creates a real privacy and data-governance risk because users may unknowingly disclose sensitive browsing targets, research interests, or tokens to an external service.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The README states that all task results are automatically saved to the logs directory but does not clearly warn users about local data persistence or its security implications. This is risky because users may process public links expecting ephemeral analysis, while the tool silently creates a durable dataset that could contain sensitive business intelligence, comments, or profiling information.

Missing User Warnings

Medium

• Confidence: 76% confidence
• Finding: This function sends an API token in a network request while the file contains no mechanism for user disclosure, consent, or minimization. Although server-side API authentication is normal, undisclosed transmission of credentials in a skill handling public-content queries can create transparency and secret-handling concerns, especially if logs, proxies, or error tooling expose request parameters.

Missing User Warnings

Medium

• Confidence: 80% confidence
• Finding: The search-result retrieval call transmits both the user's keyword and the API token over the network without any visible disclosure or minimization in this file. In context, this increases privacy risk because user queries may reveal interests or sensitive topics, and combining them with credentials can broaden exposure if requests are logged or forwarded through third-party infrastructure.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: This command sends the user-supplied Xiaohongshu URL together with authenticated API requests to an external service, but this file does not provide a clear runtime disclosure or consent boundary before transmission. In a skill advertised as link-based public-content retrieval, silent network exfiltration of user input to a third-party backend can violate user expectations and leak sensitive query parameters embedded in the URL.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The tool persists fetched comment data to a local JSON file automatically, without clear notice or a user-controlled opt-in. This creates a local data-retention risk: comment content, request metadata, and source URLs may remain on disk longer than expected and become accessible to other local users, backup systems, or later processes.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The CLI persists the keyword and full search results to a local log file named with the search term, without any clear user warning or consent. Search terms and returned content may contain sensitive or personal information, and storing them on disk increases exposure through local compromise, backups, shared workspaces, or unintended retention.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:16