guaikei·小红书搜索·详情·评论·博主

• Outcome: Review
• Latest audit: Aug 15, 2026 · 2:48 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed Xiaohongshu public-data lookup tool that uses a third-party API and saves fetched results locally, with no evidence of hidden destructive or deceptive behavior.

Install only if you are comfortable sending Xiaohongshu keywords or links, including any link query tokens, to guaikei.com using your GUAIKEI_API_TOKEN. Review or delete the generated logs directory if the fetched comments, URLs, or research topics should not remain on disk.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The CLI persists fetched comment results to a local JSON file after printing them, which expands data exposure beyond the stated 'provide data basis' behavior. Even if the source content is public, comments may contain personal data or sensitive text, and unexpected disk retention increases the risk of leakage through shared workstations, backups, or later reuse.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The CLI persists the full fetched note/comment detail payload to a local file via `log.taskWrite`, which can retain third-party content and potentially sensitive metadata longer than the user expects. In this skill’s context, the manifest emphasizes providing reference data, not local retention, so silent persistence increases privacy and data-handling risk if the host environment is shared or logs are later exfiltrated.

Description-Behavior Mismatch

Low

• Confidence: 91% confidence
• Finding: The CLI persists fetched results to a local JSON file without clear disclosure or an opt-in control. Even if the source data is public, local persistence can unintentionally retain scraped content and associated metadata on shared machines or in agent environments, increasing data exposure beyond the immediate command output.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The CLI persists full search output to a local file using a filename derived from user-controlled keyword input. Even if the skill is intended only to provide reference data, storing query terms and returned content on disk creates an unnecessary retention surface that can expose potentially sensitive user interests, scraped content, or operational metadata to other local users/processes. The skill context makes this somewhat more concerning because the manifest describes transient data provision for content ideation, not durable storage.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The activation description is broad enough to trigger on general content-creation requests even when the user did not explicitly ask to query Xiaohongshu data. In context, that can cause unexpected invocation of a third-party data-collection workflow and unnecessary transmission of user prompts, keywords, or URLs to an external service, creating privacy and consent risks.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The document mentions that data is relayed through a third-party API, but it does not clearly warn users at the point of use that provided links, keywords, and fetched content may be sent to an external service. This weakens informed consent and can expose user-supplied targets, research interests, or sensitive working context to a third party without an explicit disclosure step.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The skill sends the target note URL and parameters to an external API without an explicit user-facing disclosure at the point of execution. This is primarily a transparency and privacy issue: users may assume the tool operates locally, while their requested targets and activity metadata are actually transmitted to a third party.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The tool silently writes fetched comment data to disk, creating local retention of potentially sensitive or regulated content without explicit notice. This can increase exposure if the host is multi-user, backed up externally, or later inspected, especially since filenames are derived from the target URL and operation type.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The tool sends the supplied Xiaohongshu URL and retrieves remote detail/comment data using an API token, then may write the returned data locally, but it gives no explicit warning or consent flow about external transmission or persistence. This is dangerous because users may assume a local-only helper for inspiration research, while the skill actually performs network-backed collection and storage that can expose browsing targets, retrieved content, and account-linked usage metadata.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The code sends the full user-provided profile URL to a remote API via createPostTask/getPostTask, and the accepted URL format explicitly includes xsec_token query parameters. Transmitting embedded tokens or tracking parameters to a third-party service without explicit warning or minimization can leak user/session-linked data and expand access beyond what the user reasonably expects.

Missing User Warnings

Low

• Confidence: 92% confidence
• Finding: Writing result data to a local JSON file without clear disclosure creates an unexpected secondary sink for potentially sensitive or regulated content. In agent or multi-user environments, this can leave residual data on disk where other processes or users may later access it.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:16