Security audit

guaikei·小红书内容监控器

Security checks across malware telemetry and agentic risk

Overview

This appears to be a coherent Xiaohongshu public-data retrieval skill, with the main privacy consideration that it sends inputs to guaikei.com and saves returned results locally.

Install only if you are comfortable sending Xiaohongshu keywords, note links, profile links, and the GUAIKEI_API_TOKEN to guaikei.com. Treat saved logs as retained research data and delete them manually if queries or returned public-content results are sensitive.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill declares and depends on the sensitive environment variable `GUAIKEI_API_TOKEN`, but the metadata shown does not expose a corresponding explicit permissions model. That creates a transparency and governance gap: the skill can access secrets needed to call a third-party API without clearly signaling that capability through a permission declaration, making review, policy enforcement, and least-privilege controls harder.

Context-Inappropriate Capability

Medium

Confidence: 86% confidence
Finding: The script persists fetched results to a local JSON file even though the skill is described as read-oriented data retrieval. That creates an undeclared data-retention side effect: retrieved content, URLs, and metadata may remain on disk, be readable by other local users/processes, or be unintentionally exfiltrated via backups and log collection.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The activation description is broad enough to trigger on loosely specified Xiaohongshu-related requests, including cases where a user merely mentions the platform and provides a keyword or link. In context, that matters because invocation sends user-supplied links/keywords to an external service and creates local log archives, so over-triggering can cause unintended third-party data disclosure or unnecessary collection.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill text does not clearly warn users that keywords, note links, and profile links are transmitted to a third-party API and that each execution is archived to `logs/{...}.json`. This is dangerous because user-provided URLs and research targets may contain personal, sensitive, or proprietary context, and silent transmission plus local retention increases privacy, compliance, and data-handling risk.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The CLI writes the full task output, including scraped note details/comments and request metadata, to a local JSON file by default without explicit user consent or any warning. This creates a confidentiality risk because sensitive or regulated data may persist on disk, be readable by other local users/processes depending on filesystem permissions, or be unintentionally committed, backed up, or exfiltrated later.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The tool silently writes full task results to disk without user consent or an obvious warning. In the context of a skill meant to retrieve public platform data, silent persistence increases privacy and operational risk because output may include profile identifiers, URLs, timestamps, and collected content that remain stored after execution.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The CLI persists full search output to a local JSON file using a filename derived from the user's keyword, but it does not clearly warn the user that their query terms and returned content will be stored on disk. In this skill's context, searches may contain sensitive interests, brand-monitoring terms, or other user-provided data, so silent local persistence increases privacy and data-handling risk, especially on shared systems or ephemeral environments where logs are later collected.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:17