小红书趋势洞察

• Outcome: Review
• Latest audit: Aug 13, 2026 · 1:29 AM UTC
• Version: 1.0.0

Overview

The skill is a real Xiaohongshu data-collection tool, but its top-level description understates its broader search, note-detail, profile-post, and local-retention behavior.

Review this as a broad Xiaohongshu public-data collection skill, not just a comment analyzer. Install only if you are comfortable sending Xiaohongshu links, keywords, and your GUAIKEI_API_TOKEN to guaikei.com and having returned results saved locally in logs.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (24)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill is presented as comment-only, but the documentation exposes materially broader capabilities: keyword search, note detail retrieval, creator post collection, and link construction. This mismatch can cause operators or orchestration systems to grant, route, or trust the skill under narrower assumptions than its actual data-collection scope, enabling unauthorized over-collection of user-requested or third-party data.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The manifest advertises a narrowly scoped comment-analysis tool, while the body documents broader retrieval of search results, note details, and creator posts. Such scope deception is dangerous because downstream agents, reviewers, or policy controls may permit the skill in contexts where comment-only access is acceptable but broader scraping is not.

Intent-Code Divergence

High

• Confidence: 96% confidence
• Finding: The documentation explicitly claims it does not fetch note body content, yet its own capability table and examples include note-detail retrieval. That contradiction increases the risk of unintended data access and misleading user consent, especially where users or governance rules distinguish between comment analytics and full content collection.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The package metadata advertises a broad Xiaohongshu growth, marketing, competitor monitoring, KOL screening, and data-mining tool, which is materially broader than the declared skill purpose of comment-only retrieval for a single note. This scope mismatch is dangerous because it can mislead reviewers and users about the real capability surface, increasing the risk that broader collection or analysis functions are packaged under a narrowly described skill.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The declared scripts expose search, detail, post, and comment operations, while the skill is presented as comment-only and explicitly not for posting or broader interaction. This is a significant capability mismatch because it introduces hidden or undeclared functionality, including posting, that could enable actions beyond user consent or platform-policy expectations if invoked by the agent or a downstream wrapper.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The README markets a broad Xiaohongshu analytics suite including keyword search, note detail retrieval, competitor monitoring, and KOL screening, while the manifest says this skill should only retrieve comment data for a single note. This scope mismatch is dangerous because users, reviewers, or orchestrators may authorize or invoke the skill under the assumption of narrow comment-only access, while the documentation indicates materially broader collection and profiling capabilities.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The usage examples explicitly instruct users to run note-detail, keyword-search, and profile/post-monitoring flows that exceed the declared comment-only scope. Concrete out-of-scope commands increase the likelihood that the skill will be used for undisclosed scraping and account monitoring beyond what a user or platform policy reviewer expects.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The changelog indicates the skill historically supports broader capabilities such as keyword search, note details, and creator work monitoring, which conflicts with the current metadata claiming the skill is limited to comment retrieval only. This creates a scope-mismatch risk: an agent or operator may invoke undocumented or unintended data-access paths, weakening least-privilege assumptions and increasing the chance of overcollection or misuse.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The file documents and encourages use of search, note detail, and creator post-listing capabilities even though the skill manifest scope is limited to comment-only retrieval for a single note. This creates a scope-expansion and tool-routing risk: an agent may invoke broader data collection than the user authorized or the platform policy intended, increasing the chance of privacy overreach, policy violations, and unintended access to unrelated public content.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: Claiming the document is consistent with the new SKILL.md while describing broader capabilities can mislead an agent or operator into trusting incorrect scope information. That trust mismatch weakens human and automated review, making unauthorized capability use more likely because the contradictory document appears authoritative.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The implementation clearly goes beyond the declared skill scope of comment-only analysis: it creates and queries a note detail endpoint, then reconstructs note and user profile URLs from returned metadata. This over-collection violates least-privilege/data-minimization expectations and can expose post and author data the user did not intend to retrieve.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The module and function documentation explicitly state that the code handles note details plus comments, contradicting the published skill description that says it should only fetch comments and not正文/content. This mismatch increases the risk of silent scope creep, misleading reviewers and users about what data is actually collected.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This file implements APIs for creating and fetching published-post tasks for a blogger, while the skill metadata says the skill should only retrieve comment content, commenter info, and interaction data for a specific note. That mismatch can cause the agent to collect broader or different data than the user authorized, creating a capability-integrity issue and potential privacy overcollection risk.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The header comments and function documentation describe blogger details and published notes rather than comment-only retrieval, directly contradicting the skill's declared scope. In an agent setting, misleading documentation increases the chance that reviewers, orchestration logic, or downstream tools will approve or invoke broader data collection than intended.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The file implements keyword-based Xiaohongshu note search and constructs note/profile URLs, which materially exceeds the declared skill scope of only retrieving comments and commenter interaction data for a provided note. This scope expansion enables broader content discovery and user-profile enumeration than users or platform reviewers would expect, increasing privacy, compliance, and misuse risk.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The module header explicitly describes a note-search module, directly contradicting the manifest's claim that the skill is comment-only for a provided note. Such inconsistencies are dangerous because they conceal actual capability from operators and users, undermining trust boundaries and making unauthorized data collection harder to detect.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The CLI advertises comment/detail retrieval but also writes the full returned dataset to a local file. Because the results likely contain comment text, commenter metadata, and interaction data, this creates an additional persistent copy of potentially sensitive or regulated data on disk, increasing exposure if the host is shared, compromised, or logs are collected unexpectedly. In this skill context, the risk is elevated because the stated purpose is audience/comment analysis, so bulk personal/comment data is exactly what is being stored.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The CLI schema and help text clearly implement a blogger profile post fetcher, while the skill manifest says this skill should retrieve comment content, commenter information, and interaction data for a specific note. This scope mismatch is dangerous because users or upstream agents may invoke the skill expecting comment-only processing, but the code instead collects broader profile/post data, causing unauthorized over-collection and violating least-privilege/data-minimization expectations.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The output and persistence paths serialize and store `postTask` results, which are blogger post results rather than comment-analysis data promised by the skill description. In an agent setting, this can leak unrelated user/profile content into downstream tooling, logs, or datasets under a misleading interface, increasing privacy and compliance risk.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The file implements a general Xiaohongshu keyword search workflow that creates and retrieves note search tasks, which does not match the declared skill purpose of analyzing comments for a specific note. This capability expansion is dangerous because it enables broad content discovery and collection beyond user intent, increasing the chance of unauthorized data gathering, policy violations, and misuse of the skill as a reconnaissance/search tool.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The command schema exposes generic search parameters such as keyword, type, sort, time, and limit, providing a broad discovery interface unrelated to the stated comment-analysis-only function. In this skill context, that mismatch makes the code more dangerous because the skill can be used to enumerate content at scale rather than just analyze feedback on a user-supplied note.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The README states that all task results are automatically saved to the logs directory, but does not clearly warn users that retrieved comment content, commenter information, and interaction data may be retained on disk. In a comment-analysis context, silent retention can expose scraped personal or behavioral data to later unauthorized access, over-collection, or accidental sharing.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The CLI writes fetched data to a local JSON file automatically after successful execution, but there is no user consent flow, warning, retention control, or opt-out. Because this skill processes social-platform data and may include personal or account-related information, silent persistence increases the risk of unintended local disclosure, over-retention, and accidental reuse.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The script persists the full search output to a local JSON file, including user query metadata and returned results, without any notice or minimization in this file. This creates a privacy and data-retention risk because sensitive or proprietary search terms and collected content may remain on disk longer than expected and be accessible to other local users, processes, or backups.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:15