guaikei·小红书笔记评论工具

• Outcome: Pass
• Latest audit: Aug 16, 2026 · 2:28 AM UTC
• Version: 1.0.0

Overview

The skill is a disclosed Xiaohongshu public-data lookup tool, but it sends user queries and links to a third-party API and automatically saves returned data locally.

Install only if you are comfortable sending Xiaohongshu keywords, note/profile URLs, and a GUAIKEI API token to the third-party service, and remember that returned public data and your query context are saved locally in logs. Avoid using it for private, login-only, unauthorized, or sensitive profiling workflows.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (20)

Description-Behavior Mismatch

Medium

• Confidence: 86% confidence
• Finding: The package metadata advertises broader capabilities such as competitor monitoring, KOL filtering, user profiling, and precision marketing that exceed the stated skill scope of fetching recent notes for keyword trend monitoring. In an agent/tool ecosystem, overstated or mismatched capabilities can mislead reviewers or orchestrators about what the tool is meant to do, increasing the risk of scope creep, inappropriate invocation, or unnoticed access to functionality beyond user expectations.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The README materially expands the skill’s scope beyond the manifest’s narrowly described purpose of recent keyword-based trend monitoring. This creates a scope mismatch that can mislead users, reviewers, or orchestration systems into granting trust or permissions for a seemingly narrow skill while it advertises broader scraping and analysis functions such as competitor monitoring, note-detail retrieval, KOL screening, and comment analysis.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: Competitor account monitoring is a distinct surveillance-style capability not implied by a manifest limited to recent keyword-topic trend tracking. When undocumented in the manifest, this can bypass expected scope review and enable collection or analysis of account-level activity that users or platforms did not anticipate from the declared skill purpose.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: KOL screening introduces profiling and evaluative analysis of creators, which goes beyond simple keyword trend discovery. Because this broader capability is not justified by the manifest, it increases the risk of undeclared data use and misuse of the skill for actor profiling under the cover of a narrower trend-monitoring description.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: Comment analysis can expose richer user-generated content and sentiment data than a basic recent-keyword note listing workflow. If the manifest only declares trend monitoring, advertising comment-analysis capability creates an undeclared expansion in data access and analysis scope, which is risky from both security-review and privacy-expectation perspectives.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The file documents four operational capabilities—keyword search, note detail retrieval, comment scraping, and creator post listing—while the skill metadata describes a narrower purpose focused on recent keyword-sorted trend discovery. This scope expansion can cause the agent to invoke data-collection behaviors the user or platform operator did not expect, increasing the chance of over-collection and misuse of the skill beyond its declared trust boundary.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: Branding the skill as an 'insight and competitor analysis assistant' with four capabilities materially broadens operator expectations beyond the manifest's stated single-use trend/hotspot purpose. This mismatch is dangerous because agents and users may rely on the manifest for safety scoping, while the documentation quietly authorizes richer surveillance-style collection such as competitor monitoring and comment harvesting.

Description-Behavior Mismatch

High

• Confidence: 91% confidence
• Finding: The file implements comment task creation and retrieval for a specific Xiaohongshu note, which materially differs from the declared skill purpose of fetching recent keyword-based notes and monitoring trends. This kind of capability mismatch is dangerous because it can cause the agent to collect or process user-provided note URLs and comment data outside the user’s expected scope, enabling covert data collection or unauthorized surveillance behavior.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The file implements creation and retrieval of single-note detail and comment tasks, which exceeds the declared skill scope of keyword-based recent-note trend monitoring. In an agent setting, scope expansion matters because it enables collection of granular content and comments from specific posts, increasing privacy, compliance, and misuse risk beyond what users and reviewers would expect from the listed capability.

Context-Inappropriate Capability

Medium

• Confidence: 83% confidence
• Finding: The CLI persists fetched comment results to a local JSON file by default, which can retain potentially sensitive or personal data longer than necessary and expose it to other local users, backups, or later unintended processing. In this skill context, trend monitoring does not obviously require durable storage of full comment payloads, so default logging increases privacy and data-minimization risk.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The tool persists fetched note details and comment data to a local JSON file without any indication of minimization, retention limits, or user consent. Even if the source content is public, local persistence increases the risk of unintended disclosure, over-collection, and reuse of scraped comment data beyond the stated trend-monitoring purpose.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The implementation accepts a blogger profile URL and retrieves homepage posts, which materially contradicts the skill’s declared purpose of fetching recent keyword-based notes sorted by newest. This kind of capability mismatch is dangerous because downstream users or agents may supply topic keywords expecting trend monitoring, but the skill instead operates on profile URLs and can collect a specific creator’s content, expanding data access and behavior beyond what the manifest authorizes.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The help text and inline guidance repeatedly describe a 'blogger link' and 'homepage notes', reinforcing behavior that conflicts with the published keyword-trend skill description. Misleading documentation increases the risk of unsafe or unauthorized use because operators and orchestrating agents may trust the manifest while the executable guides them toward a different data target and collection pattern.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The skill metadata says it is for fetching recent Xiaohongshu notes sorted by latest to monitor near-term trends, but the CLI exposes broader modes including comprehensive ranking, likes, comments, favorites, and no time limit. This capability mismatch can mislead users and orchestrators about what the skill can actually do, enabling collection or analysis outside the declared scope and weakening trust and policy enforcement.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The skill writes full search results to a local JSON log file without this behavior being justified by the stated read-only trend-monitoring purpose. Persisting externally sourced content and user query context increases data-retention and privacy risk, especially on shared hosts or multi-tenant agent environments where local files may be accessible beyond the immediate session.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill states that all execution results are automatically written to a local logs directory using filenames derived from keywords or link identifiers, but it does not clearly foreground that user-supplied search terms and URLs will be persisted. This can expose sensitive research topics, private working context, or shared-link identifiers to other local users, backups, or downstream tooling, especially in multi-user or managed environments.

Missing User Warnings

Medium

• Confidence: 80% confidence
• Finding: The code sends the API token and target URL to a remote endpoint, but this file contains no user-visible notice, consent flow, or minimization controls around that transmission. In a skill whose public description emphasizes trend monitoring rather than note/comment collection, this undisclosed export of identifiers is more sensitive because users may not reasonably expect specific note URLs and associated access tokens to be transmitted for comment scraping.

Missing User Warnings

Medium

• Confidence: 80% confidence
• Finding: The query path again transmits the token and note URL to a remote service to retrieve comment-task results, without any evidence in this file of transparency, consent, or scoping controls. Repeated undisclosed transmission increases exposure of secrets and user-linked targets, especially given the mismatch between the advertised trend-analysis use case and the actual comment-harvesting behavior.

Missing User Warnings

Low

• Confidence: 92% confidence
• Finding: The CLI writes fetched note/comment results to disk without warning the user, which can create a hidden local data-retention channel. Persisted files may expose scraped content to other local users, backups, or downstream processes, especially if comments contain personal or sensitive information.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Search results are silently written to disk with no user-facing warning, despite the skill presenting itself as a search utility. Undisclosed persistence can violate user expectations and internal data-handling policies, and may expose searched topics and returned content to later unintended access.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.