guaikei·小红书数据采集工具

• Outcome: Pass
• Latest audit: Aug 16, 2026 · 2:13 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed Xiaohongshu public-data collection tool, but users should be aware it sends queries to a third-party API and saves returned results locally.

Install only if you are comfortable sending Xiaohongshu keywords or URLs and your GUAIKEI_API_TOKEN to guaikei.com. Treat returned comments and profile-linked public content as privacy-relevant, and delete the logs directory when you do not want research targets or collected results retained locally.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill requires the GUAIKEI_API_TOKEN environment variable but does not declare permissions in a structured, user-visible way. This weakens security transparency and reviewability, increasing the chance that the skill gains access to secrets without adequate operator awareness or policy enforcement.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The declared purpose focuses on engagement metrics, but the skill instructions also cover keyword search, note detail retrieval, comments collection, and creator post monitoring. This broader data collection surface can mislead users and reviewers about what data leaves the system, creating consent, privacy, and governance risks when richer content is fetched than the description suggests.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The README describes a substantially broader surveillance and scraping capability set than the manifest’s narrower purpose of evaluating KOL engagement quality. This mismatch is dangerous because reviewers or users may authorize the skill for a limited use case while the documentation encourages expanded collection and monitoring workflows, increasing the chance of misuse, over-collection, and policy circumvention.

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The README claims the tool does not involve user privacy data, yet it also advertises comment-detail collection and returning all visible valuable data. Even if the data is publicly accessible, comments and engagement records can still contain personal information or behavioral data, so this claim may mislead users and reduce scrutiny around privacy and compliance risks.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The documentation materially broadens the skill from KOL interaction-quality assessment into general Xiaohongshu search, competitor monitoring, trend analysis, and comment harvesting. This scope expansion increases the chance the skill is invoked for surveillance or broad scraping tasks beyond the user-declared purpose, weakening least-privilege and making misuse easier.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The keyword-search section enables open-ended content discovery unrelated to evaluating a specific creator's engagement authenticity. In an agent setting, this can be repurposed to collect large volumes of public content for profiling, monitoring, or dataset building, which exceeds the narrowly described business need and increases abuse potential.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The skill metadata says it is for retrieving real like/comment/favorite counts to assess engagement quality, but this CLI creates a comment task, fetches comment results, and returns raw comment data in `results`. That is a scope expansion from aggregate analytics into content collection, which increases privacy and compliance risk because user-generated text may contain personal or sensitive information not needed for the stated purpose.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: After retrieving comment results, the CLI writes the full output to a local JSON file via `log.taskWrite(...)`. Persisting collected comment data creates unnecessary retention and secondary exposure risk, especially because the skill’s stated use case is read-only analytics rather than storing user-generated content.

Context-Inappropriate Capability

Low

• Confidence: 80% confidence
• Finding: The CLI persists collected results to a local file by default, which expands data exposure beyond transient read-only analytics. On shared systems or poorly secured environments, these files may disclose queried targets, collected engagement data, and execution metadata to other local users or later processes.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill description does not clearly warn users that their input links/keywords and fetched results are automatically archived to local log files. This creates hidden persistence of potentially sensitive research targets and collected content, undermining informed consent and increasing the risk of later unauthorized access or reuse.

Missing User Warnings

Low

• Confidence: 80% confidence
• Finding: The documentation instructs collection of public notes, post details, and comments but does not warn about privacy, platform terms, retention, or downstream handling of user-generated content. Even when data is public, omission of these safeguards can lead to over-collection, improper storage, or secondary use of personal data in ways users and operators may not expect.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The CLI sends the supplied note URL and API token to external comment-task endpoints (`createCommentTask`/`getCommentTask`) without an explicit warning or consent prompt that request data is being transmitted off-host. In this skill context, that matters because the tool appears to be an analytics helper, but users may not expect note URLs, tokens, and potentially associated query parameters to be shared with a third-party service.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The CLI sends the supplied profile URL to a remote API and later writes returned results to disk without an explicit user warning or consent flow. While network transmission is inherent to the skill's purpose, the lack of clear disclosure increases privacy and operational risk because users may not realize inputs and results are both leaving the process boundary and being retained locally.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The code persists search results to a local JSON file using a filename derived in part from user input, without any consent, retention notice, or visible opt-in in this file. In the skill context, collected platform data and searched keywords may reveal business research targets or user interests, so silent local persistence increases privacy and data-handling risk, especially on shared hosts or multi-user environments.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: Automatically archiving every execution result to logs using timestamps plus keyword or link identifiers creates a durable data-retention channel for user-supplied targets and collected content. Even if the source data is public, the resulting logs can reveal user interests, investigation subjects, and accumulated datasets, and may be easier to exfiltrate or misuse than the live queries themselves.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.