Security audit

guaikei·小红书爆款挖掘

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Xiaohongshu data tool, but it needs Review because it can collect comments and creator-post data through a third-party API and automatically save full results locally.

Review before installing. Use it only for public Xiaohongshu data you are comfortable sending to GuaiKei, avoid sensitive research topics or private/internal target lists, and be aware that returned results are automatically saved under logs without a built-in retention or disable control.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (27)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The public description says the skill is for keyword-based Xiaohongshu note search, but the body expands capabilities to note-detail retrieval, comment extraction, creator post monitoring, and saving results locally. This mismatch can cause the agent to invoke the skill in contexts where users did not consent to broader collection, third-party transmission, or local persistence, increasing privacy and data-handling risk.

Description-Behavior Mismatch

Medium

Confidence: 84% confidence
Finding: The package metadata advertises broader capabilities such as competitor monitoring, KOL targeting, precise marketing, and user profiling, while the declared skill purpose is limited to searching public Xiaohongshu notes by keyword. This mismatch can mislead reviewers and downstream agents about the tool’s intended scope, increasing the risk of capability creep, privacy-invasive use, or later inclusion of undeclared data collection and marketing behaviors.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The README advertises materially broader capabilities than the manifest description, including note detail lookup, account monitoring, comment analysis, and KOL screening. This creates a scope-transparency problem: users and platform reviewers may authorize or invoke the skill expecting only keyword-based public-content search, while the implementation and docs encourage surveillance-style or profiling use cases beyond the declared purpose.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The README positions the tool for precise marketing, competitor monitoring, and KOL screening, which conflicts with the manifest’s stated exclusion of SEO/ad-tooling style use. This mismatch can facilitate policy evasion by presenting a narrower purpose in metadata while steering users toward profiling and marketing-intelligence workflows in the documentation.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The changelog advertises capabilities beyond the manifest’s declared scope, including comment retrieval, note details, creator monitoring, and sentiment analysis. This scope mismatch can mislead orchestrators, reviewers, or users about what the skill can do, increasing the risk of unauthorized data collection or use of functions that were not properly disclosed, reviewed, or permissioned.

Description-Behavior Mismatch

Medium

Confidence: 86% confidence
Finding: The changelog claims commercial analysis uses such as competitor analysis, KOL screening, and trend monitoring that go beyond the manifest’s narrower description of viewing related Xiaohongshu content performance. Even if only documentation-level, this expands the apparent operational purpose of the skill and can facilitate misuse in contexts that were not disclosed or approved.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The documentation materially expands the skill from the manifest’s stated keyword-search purpose into note-detail scraping, comment retrieval, and creator-post collection. This scope mismatch is dangerous because users, reviewers, and policy controls may authorize a narrower capability while the actual skill enables broader data collection and profiling workflows.

Description-Behavior Mismatch

Medium

Confidence: 87% confidence
Finding: This file implements comment-collection APIs even though the skill metadata describes only public note search and content-performance lookup. That capability expansion increases data access beyond the declared purpose, which is risky because comments can contain additional user-generated content and identifiers that users may not expect to be collected under a search-oriented skill.

Context-Inappropriate Capability

Medium

Confidence: 84% confidence
Finding: Fetching note comments is not clearly necessary for the stated use case of searching Xiaohongshu notes by keyword and returning titles, summaries, authors, metrics, and links. This creates unjustified collection of extra social data, which can broaden privacy and compliance exposure and make the skill behave in ways users did not request.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The file implements note-detail and comment retrieval, while the skill description promises keyword-based discovery of public notes and related metadata. This scope expansion increases data access beyond what users would reasonably expect, especially because comments and full note details can contain more personal or sensitive content than search summaries. The mismatch is risky because users invoking a 'viral mining' or search-oriented skill may not realize a supplied URL triggers deeper collection from a remote service.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The file implements APIs to create and retrieve a task for scraping a creator's published posts by profile URL, which exceeds the declared skill scope of keyword-based search over public notes. This scope drift is security-relevant because it introduces a broader data collection capability than users and reviewers were told to expect, enabling profile-targeted harvesting and potentially bypassing policy or consent expectations tied to the advertised functionality.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: This CLI implements comment retrieval for a specific Xiaohongshu note, which is materially broader than the declared skill scope of keyword-based public note search returning note metadata and links. Scope expansion matters in agent settings because it enables collection of additional user-generated content that may contain personal data, increasing privacy, compliance, and misuse risk beyond what callers would reasonably expect from the manifest.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The code persists comment results to a local file via log.taskWrite, even though the stated purpose is to return search-style results to the caller. Unnecessary local persistence increases data exposure surface: comment content may contain personal information, and saved files can be accessed later by other local users, processes, backups, or logs without the user's awareness.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The CLI performs a note-detail retrieval workflow and returns note/comment content, which goes beyond the skill manifest’s stated scope of keyword-based public note search. This capability mismatch is security-relevant because downstream users and orchestrators may grant the skill broader access or trust assumptions than intended, leading to undisclosed collection and processing of richer user-generated content.

Description-Behavior Mismatch

Low

Confidence: 91% confidence
Finding: The code writes the full fetched result set to a local file via log.taskWrite, creating persistent storage of retrieved content that is not disclosed in the manifest’s read/query-oriented description. Undisclosed persistence increases data retention risk, especially if note details or comments contain personal data, and can expose results to other local users, backups, or later compromise.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: The CLI schema and help text clearly implement creator-profile harvesting by requiring a profile URL and a note-count limit, which conflicts with the manifest's stated purpose of keyword-based public note search. This kind of scope drift is dangerous because it can cause the agent to collect a different class of data than the user and platform policy expect, enabling account-targeted scraping under the cover of a benign social-topic search skill.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The core execution path creates and retrieves a post task using a supplied profile URL, confirming that the runtime behavior performs profile-centric harvesting rather than the advertised keyword/topic lookup. In an agent setting, this mismatch is security-relevant because tool-selection and consent depend on the manifest; a deceptive or inaccurate manifest can lead to unauthorized collection and transmission of account-specific data.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The CLI writes full search results, including the user's query and returned content metadata, to a local JSON file without any explicit consent or clear disclosure in the skill behavior. This creates an unnecessary persistence channel for potentially sensitive research activity and can expose data to other local users, backup systems, or later unintended processing.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The description allows auto-invocation even when the user did not ask for Xiaohongshu specifically, as long as the intent is to understand a term's social-media performance. That broad trigger can lead to unintended data sharing with an external service, mistaken tool use for non-Xiaohongshu requests, and collection beyond user expectations.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill states that data is routed through a third-party API, but it does not instruct the agent to tell the user this before transmitting user-supplied keywords or URLs. This creates a consent and privacy problem because potentially sensitive research targets, account URLs, or investigation topics may be sent externally without informed user approval.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The README states that all task results are automatically saved under logs/ with filenames derived from timestamps and keywords/links, but it does not clearly warn users before use about persistent local storage of searched terms and queried URLs. This can expose sensitive research topics, monitored accounts, or internal campaign interests to other local users, backups, or downstream log collection systems.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The document instructs users to retrieve note details, comments, and creator posts but provides no privacy or data-handling warning. Even if the content is publicly accessible, collecting and aggregating comments and creator activity can enable profiling, large-scale monitoring, or downstream misuse without informed user awareness.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The setup section requires an external API token but does not disclose that user queries, note URLs, or profile URLs may be transmitted to a third-party service. This is dangerous because users may provide sensitive targets or research topics without informed consent about external data sharing and logging.

Missing User Warnings

Medium

Confidence: 82% confidence
Finding: This code sends an API token to a remote endpoint without any visible disclosure, consent flow, or minimization controls in this file. While transmitting a token to an API is normal, the security issue here is undisclosed outbound transmission in a user-facing skill that may cause operators or users to underestimate what credentials and request context are being shared externally.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The function transmits both the API token and a user-supplied URL to a remote service, but the skill description does not clearly disclose that arbitrary URLs provided by the user will be sent off-platform. In this skill context, that is more dangerous because the manifest frames the capability as keyword-based social-media trend lookup, not external submission of specific URLs for detail and comment extraction.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:16