Security audit

guaikei-xhs-public-data

Security checks across malware telemetry and agentic risk

Overview

This skill coherently fetches public Xiaohongshu data through a third-party API, with clear caveats about API use and automatic local logs.

Install only if you are comfortable sending Xiaohongshu keywords, URLs, and the GUAIKEI_API_TOKEN to guaikei.com. Treat the local logs directory as retained research data because it can contain scraped comments, profile/note URLs, and access-like query tokens; delete or protect those files on shared or synced machines.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The CLI persists fetched note details and comments to a local JSON log file after returning the results. Because the skill is described as a data-fetching tool rather than a persistence tool, this creates unexpected local retention of potentially sensitive public data, increasing exposure to other local users, backups, or later unintended reuse.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The description says the skill should be used even when the user did not say 'operations/运营' as long as the goal is decision-making driven by Xiaohongshu data, which is broader than a narrowly scoped trigger. In an agentic environment, this can cause over-activation on loosely related requests and unnecessary transmission of user-supplied keywords/URLs to a third-party API, increasing data exposure and unintended external calls.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The README states that all task results are automatically saved to a local logs/ directory, but it does not warn users about retention, access control, or the fact that scraped public-platform content and analysis outputs may persist on disk. In this skill's context, the data may include competitor monitoring results, comment text, KOL profiles, and URLs, which can create unnecessary data exposure on shared machines or in synced workspaces if not handled carefully.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: The document instructs users to configure an API token and retrieve public posts/comments, but it does not warn that URLs, comment text, account identifiers, and access tokens may be transmitted to a third-party service. This can lead to unintentional exposure of sensitive business monitoring targets or personal data in comments, especially when users assume the skill is only doing local processing.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The CLI persists retrieved comment data to a local JSON file automatically, but the file contains potentially sensitive operational data and there is no explicit user warning, consent prompt, or option to disable persistence in this code path. In shared environments, CI runners, or multi-user systems, this can lead to unintended retention or disclosure of scraped data through local filesystem access, backups, or artifact collection.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The program silently writes fetched note details to a local JSON file without explicit user warning or consent. Even if the source content is publicly accessible, comments and collected datasets can become more privacy-sensitive once aggregated and retained locally, especially on shared systems or in automated workflows.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The CLI writes the full request/output payload to a local file, including the user-supplied URL and returned data, without any explicit disclosure or opt-in in this file. In this skill’s context, the URL may contain tracking or access-related query parameters such as xsec_token, so persisting it locally can expose sensitive user activity or tokens to other local users, backups, or logs.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.