Security audit

guaikei·小红书看博主

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed Xiaohongshu public-data retrieval skill, with expected third-party API use and local result logging that users should understand before installing.

Install this only if you are comfortable using a guaikei.com API token, sending Xiaohongshu keywords or URLs to that service, and storing returned public comments/profile/note data in local log files. Avoid using it for private, confidential, or unauthorized targets, and periodically delete logs if retained social-media data is not needed.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The CLI writes the full comment task output to a local JSON file after successful execution, which can persist scraped comment data beyond the immediate run without explicit necessity, retention limits, or user consent. If the comments contain personal data or sensitive identifiers, this creates avoidable local data-at-rest exposure through shared workstations, backups, or later exfiltration.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The description says the skill should activate even when the user did not explicitly ask for comment analysis, as long as they provide a note link and show general interest in audience feedback. That broad trigger can cause the agent to invoke an external data-fetching skill on ambiguous requests, increasing the chance of unintended collection and transmission of user-supplied URLs and related content to a third-party API.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The scenario phrases are broad, natural-language prompts that can overlap with unrelated analysis or casual discussion requests. In an agent setting, this can lead to over-eager tool activation and unnecessary external API calls, exposing user-provided links or research targets without sufficiently clear user intent.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The additional trigger examples continue the same pattern of vague conversational activation without explicit boundaries. This raises the risk that the agent will treat loosely related requests as authorization to fetch third-party data, which is especially problematic because the skill can collect comments, commenter information, and engagement data.

Missing User Warnings

Low

Confidence: 88% confidence
Finding: Although the document mentions reliance on a third-party API and asks users to confirm authorization, it does not clearly state at execution points that supplied note/profile URLs and requested content will be transmitted externally. This weak disclosure can undermine informed consent and create privacy/compliance issues when users or agents pass potentially sensitive research targets to the provider.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The natural-language trigger examples for keyword search are broad enough to overlap with ordinary user requests, which can cause the agent to invoke the search capability without first confirming scope or required inputs. In an agent setting, ambiguous triggers increase the risk of unintended external calls, unnecessary data collection, or execution of the wrong workflow.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The note-detail trigger examples describe analysis goals but do not clearly constrain when the detail CLI should be called or require a note URL up front. This ambiguity can lead the agent to misfire on generic 'analyze comments' requests and proceed toward an external retrieval step without sufficient user confirmation.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The blogger-post query examples are phrased broadly and do not consistently emphasize that the input must be a creator profile URL. In an automated agent workflow, this can cause confusion between note-detail and profile-listing operations, producing unintended requests and inaccurate data retrieval.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The comment-query examples are generic enough to match ordinary analysis requests, making it unclear when the comments-only CLI should be invoked instead of a higher-level reasoning step. This can result in unintended scraping-style collection of comment data or misuse of the wrong capability.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The code saves comment results to disk without any explicit warning at runtime or in the command interface that fetched content will be written locally. This can surprise operators and lead to inadvertent collection and retention of third-party content, increasing privacy and compliance risk in environments where users expect stdout-only behavior.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The CLI sends a user-provided note URL and an API token to an external service without an explicit warning or consent prompt at the point of transmission. Even if this is intended functionality, users may not realize that their input is being transmitted off-host, which creates privacy and trust risks, especially if URLs contain tracking or access parameters such as xsec_token.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The CLI writes the full result payload to a local file using a filename derived from the target URL, without any explicit notice, consent, or option to disable persistence. Because the output may contain scraped profile/post data and request context, this creates a confidentiality risk on shared systems or in automated environments where local artifacts are retained, synced, or exposed to other users/processes.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:16