Security audit

guaikei·小红书多维数据工具

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Xiaohongshu public-data collection tool that uses a Guaikei API token and saves results locally, with no evidence of hidden or destructive behavior.

Install only if you are comfortable using a third-party Guaikei API token and saving fetched Xiaohongshu public-data results to local log files. Avoid running it on shared machines for sensitive research unless you plan to clean up the logs directory.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill requires a sensitive environment variable (`GUAIKEI_API_TOKEN`) but does not declare corresponding permissions/capabilities explicitly. This creates a transparency and governance gap: an agent or reviewer may underestimate what secrets the skill consumes, increasing the risk of unsafe execution or accidental token exposure through surrounding tooling, logs, or orchestration.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The activation text is broad enough to match many generic requests involving Xiaohongshu data retrieval, even when the user did not explicitly ask to scrape or collect data. Over-broad triggering can cause unintended third-party data access, unnecessary API calls, and privacy/compliance issues because the skill may activate in situations where a safer or less invasive response would suffice.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill states that every execution archives fetched results to local `logs/{timestamp}_{identifier}_{command}.json`, but this persistence is not clearly disclosed alongside the broader third-party data handling warnings. Silent local retention increases the risk of sensitive or regulated content being stored longer than expected, discoverable by other local users/processes, or included in backups and later exfiltrated.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The README states that all task results are automatically saved to the logs/ directory, but it does not clearly warn users that scraped URLs, keywords, and analysis outputs may be persisted to disk. For a data-scraping skill, these artifacts can contain sensitive business research, competitor monitoring targets, or personal data from public profiles/comments, creating confidentiality and retention risks on shared or unmanaged systems.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The tool persists the full request and returned results to a local JSON file without an explicit opt-in or clear user warning. Because the saved data includes the queried profile URL and scraped content, it can create unintended local data retention and exposure risks on shared machines, CI runners, or environments with broad filesystem access.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The CLI persists the full search output to a local JSON file automatically after execution, but does not clearly warn the user that potentially sensitive collected data and query terms will be stored on disk. In this skill’s context, the data comes from social-platform scraping and may contain personal content, identifiers, or research targets, so silent persistence increases the risk of unintended retention, later disclosure, or mishandling on shared systems.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:17