guaikei·小红书公开笔记数据

• Outcome: Review
• Latest audit: Aug 15, 2026 · 2:53 AM UTC
• Version: 1.0.0

Overview

The skill is a disclosed command-line wrapper for public Xiaohongshu data retrieval via guaikei.com, with local result logging but no hidden destructive or credential-harvesting behavior found.

Install only if you are comfortable sending Xiaohongshu keywords or URLs and your guaikei.com API token to that service. Treat returned comments, creator-post data, and saved logs as retained public-data records; delete logs when no longer needed and avoid using the tool for private, login-only, or policy-restricted content.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (18)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence
• Finding: The top-level description narrows the skill to keyword-based public-note search, but the body documents broader capabilities: fetching note details and comments by URL, monitoring a creator profile, and saving retrieved data locally under a logs directory. This mismatch is dangerous because it can cause users or orchestrators to authorize or invoke the skill under incomplete assumptions, increasing the risk of unintended data collection, retention, and third-party data transfer.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The README documents capabilities materially broader than the declared skill scope, including note detail retrieval, account monitoring, and comment analysis. This creates a scope-transparency and least-privilege problem: reviewers and users may approve or invoke a skill under the assumption it only performs keyword search, while the implementation or operator expectations may extend to richer collection and profiling functions.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The README advertises competitive monitoring, KOL screening, and trend prediction beyond the narrower manifest description of public-note keyword search and comparison. Overstated capabilities can mask data-use expansion and lead downstream agents or users to request surveillance-style analysis that was not transparently disclosed during onboarding or approval.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The changelog advertises capabilities to fetch comment information and distinguishes routes for keyword search, note details, comments, and creator monitoring, which exceeds the manifest’s declared scope of searching public notes and returning interaction data. This creates a scope-mismatch vulnerability: downstream agents or reviewers may trust the broader documentation and invoke undeclared data collection behaviors, weakening permission boundaries and policy enforcement.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The changelog explicitly states creator work monitoring/scraping functionality, which is materially different from the declared keyword-search use case. Undeclared scraping/monitoring features can be abused for persistent profiling or collection beyond user expectations, especially if an orchestrating agent relies on embedded docs rather than the manifest for capability discovery.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The changelog claims note-detail retrieval and comment sentiment analysis, which goes beyond the manifest’s stated keyword search and interaction metrics. This discrepancy is dangerous because it can mislead agents into invoking undeclared analysis on additional content types, increasing data processing scope and undermining least-privilege assumptions during security review.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The documentation advertises four operational capabilities, including fetching note details, comments, and creator post histories, while the manifest describes a keyword-search-only skill. This scope mismatch is dangerous because an orchestrator or reviewer may approve or invoke the skill under narrower assumptions, while the implementation guidance enables broader data collection and analysis than expected.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The statement that this document is consistent with SKILL.md increases trust while the file goes on to describe a broader capability set than the manifest. That misleading consistency claim can cause downstream agents or human reviewers to treat the skill as already validated, masking unauthorized expansion of behavior and weakening security gating.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The file implements creation and retrieval of Xiaohongshu comment-collection tasks, which is broader than the declared skill purpose of searching public notes and ranking/filtering note results. This capability expansion matters because comments can contain additional user-generated data and enables collection workflows not disclosed in the manifest, undermining least-privilege expectations and making downstream misuse or over-collection more likely.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The file implements note-detail and comment retrieval endpoints, including fetching full note metadata and comment content, while the skill metadata describes keyword-based public note search, ranking, and trend comparison. This capability expansion increases data access beyond the declared user expectation and can expose richer content, user profile links, and comments that may contain personal or sensitive information, creating a scope-creep/privacy risk if invoked without clear disclosure or authorization boundaries.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The manifest says this skill performs keyword-based search over public Xiaohongshu notes, but this module instead creates and queries tasks for a blogger URL to retrieve published posts. That scope mismatch is dangerous because it can cause the agent to access creator-profile-derived data paths the user did not request, violating least surprise and potentially expanding collection from keyword-level trend research to account-targeted scraping.

Description-Behavior Mismatch

High

• Confidence: 91% confidence
• Finding: The CLI retrieves and returns full comment data for a Xiaohongshu note, which goes beyond the declared skill scope of searching public notes and returning note lists plus engagement metrics. This scope mismatch is dangerous because downstream agents or users may invoke the skill expecting only aggregate research data, but instead receive potentially sensitive user-generated content, increasing privacy, compliance, and least-privilege risks.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The CLI performs a detail fetch that can retrieve full note data and comments, while the skill description presents the capability as keyword-based public note search and ranking/heat analysis. This is a scope-expansion issue: users or downstream systems may grant trust based on the manifest, but the code can access and expose richer content than disclosed, increasing privacy/compliance risk and violating least surprise.

Description-Behavior Mismatch

Low

• Confidence: 96% confidence
• Finding: The code writes the full fetched result set to a local file, but this persistence behavior is not disclosed in the skill description. Undisclosed local storage of scraped content can create data retention, confidentiality, and forensic exposure risks, especially if comments or metadata are sensitive and log files are accessible to other users or processes.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The CLI’s actual interface and behavior are materially different from the declared skill purpose: it accepts a blogger profile URL and fetches that account’s homepage notes rather than searching public notes by keyword. This kind of capability mismatch is dangerous because downstream agents or users may invoke the skill under false assumptions, causing collection of unintended data, bypass of policy scoping, or use of a broader/nondocumented capability than was reviewed.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The help text and user-facing documentation explicitly instruct users to provide a blogger link and describe retrieving homepage notes, confirming the implementation drift from the advertised keyword-research skill. Misleading documentation increases the chance that orchestration systems, reviewers, or users will authorize or route requests incorrectly, expanding data access beyond intended boundaries.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The CLI writes the full search output, including the user-supplied keyword and returned results, to a local file after completing the task. The skill description only requires searching public notes and returning results, so this creates undisclosed data retention that can expose user queries and scraped content to other local users, backups, or later compromise.

Context-Inappropriate Capability

Low

• Confidence: 89% confidence
• Finding: The code performs local task/result logging unrelated to the core user-facing function of keyword search, which increases the data footprint beyond what the skill promises. Even though the searched content is public, the query history and result sets can still reveal user interests or research topics and may be unintentionally exposed on the host system.

VirusTotal

48/48 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:17