Security audit

guaikei-xhs-search-notes-get-comments

Security checks across malware telemetry and agentic risk

Overview

This skill appears to be a legitimate Xiaohongshu public-data fetching tool, with expected third-party API use and local result logging that users should understand.

Install only if you are comfortable sending Xiaohongshu keywords or links to guaikei.com and storing returned public-data results in local JSON log files. Treat GUAIKEI_API_TOKEN as a secret, avoid running this on shared workspaces unless log retention is acceptable, and use it only for public data and authorized research workflows.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The CLI persists full search output to a local file using a filename derived from user-controlled keyword input. Even though the skill is described as a data-fetching utility, this creates an unadvertised data-retention side effect that can expose searched terms and returned content to other local users, backups, or later processes. In a marketing/research context, keywords and results may contain sensitive business intelligence or user data, so silent local storage increases risk.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The skill's applicability guidance is broad enough to encourage invocation for loosely related 'data-driven' Xiaohongshu tasks, which can cause over-collection and unnecessary transmission of user-provided links, keywords, and fetched platform data to a third-party API. In this context the danger is not code execution but policy drift: the agent may call the skill when a lighter, non-external response would suffice, increasing privacy, compliance, and data-minimization risk.

Missing User Warnings

Low

Confidence: 94% confidence
Finding: The document instructs users to configure `GUAIKEI_API_TOKEN` but does not state that it is a sensitive secret that must not be hardcoded, committed, or exposed in logs. In a tooling context, omission of basic secret-handling guidance can lead to accidental credential leakage through shell history, screenshots, shared config files, CI logs, or source control.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The CLI persists fetched comment results to a local JSON file automatically, but the user is not clearly warned that potentially sensitive or regulated content will be stored on disk. This increases the risk of unintended data retention, later disclosure through backups/shared workspaces, or exposure to other local users/processes, especially because the skill is explicitly designed for data collection and analysis workflows.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The tool sends the user-supplied note URL together with an API token to external comment-task APIs, but the code does not provide explicit user disclosure or consent about this transmission. In a data-gathering skill this is expected behavior, but undisclosed outbound transmission can still create privacy, compliance, and trust issues, especially if users assume processing is local.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The CLI writes the full result payload, including note details/comments and the original request URL, to a local JSON file automatically without warning or opt-in. This can leak potentially sensitive or regulated data into local storage, shell environments, shared workstations, CI runners, or backup/sync systems where users may not expect persistent retention.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill sends the user-provided note URL and comment limit to remote APIs (`createDetailTask`/`getDetailTask`) after only local format validation, but this file does not clearly disclose that user input and derived data will be transmitted off-host. In a data-collection skill this is functionally expected, but lack of explicit disclosure can still create privacy, compliance, and user-consent issues, especially if the URL embeds tokens or identifiers.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:16