Security audit

guaikei·小红书搜索与详情获取

Security checks across malware telemetry and agentic risk

Overview

This skill appears to be a public Xiaohongshu data tool, but its top description understates broader search, note-detail, profile-post collection, third-party API use, and automatic local logging.

Review this as a broad Xiaohongshu public-data mining skill, not only a comment analyzer. Install only if you are comfortable sending your API token plus Xiaohongshu keywords, note links, profile links, and retrieved results to the third-party GUAIKEI service, and with results being saved locally under logs/ by default.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (27)

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: The manifest/description frames the skill as a comment-only analyzer, but the body documents materially broader functionality: keyword search, note detail retrieval, and blogger post monitoring. This scope mismatch can mislead users and safety systems into authorizing a narrower data-access pattern than the skill actually encourages, increasing the chance of unintended data collection and overbroad use.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The documentation explicitly says the skill differs from note-detail retrieval by returning only comments, then later instructs use of note-detail and other non-comment functions. This inconsistency can cause an operator to invoke a broader data retrieval path than intended, exposing post content and additional metadata when the user expected comment-only processing.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The package metadata advertises broad capabilities such as data mining, competitor monitoring, KOL screening, and account growth, which materially exceed the declared skill purpose of only retrieving comments for analysis. This scope mismatch is dangerous because it can mislead reviewers and users about what functionality is bundled, increasing the chance that broader data collection or marketing-oriented behavior is invoked under a narrower trust boundary.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: The declared scripts expose search, detail, post, and comment entry points, while the skill is described as comment-only and explicitly not for posting or broader note retrieval. This is a significant trust-boundary violation because hidden or undeclared capabilities can be invoked intentionally or accidentally, enabling actions or data access beyond what the user consented to.

Description-Behavior Mismatch

High

Confidence: 94% confidence
Finding: The README markets and documents a broad Xiaohongshu data-mining suite with search, detail, competitor monitoring, and KOL analysis, while the manifest says the skill should only retrieve comment content and related engagement data. This scope mismatch is dangerous because users, reviewers, or orchestrators may invoke capabilities beyond the declared permission boundary, increasing the risk of unauthorized collection and misuse of platform data.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The introductory documentation explicitly describes the tool as a general search-and-detail analytics product, contradicting the comment-only intent in the skill metadata. Even if this is only documentation, such contradictions can mislead operators into approving or using the skill for broader scraping and analytics than intended, undermining least-privilege review and trust in the package.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The changelog describes materially broader capabilities than the declared comment-only scope, including keyword search, note detail retrieval, blogger work monitoring, and sentiment analysis. This creates scope ambiguity that can lead an orchestrator or reviewer to permit data access and behavior beyond the manifest’s intended bounds, weakening trust and policy enforcement even if the file itself is only documentation.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The version history says the skill was broadened from a narrow search skill into a more general Xiaohongshu tool, which conflicts with the manifest’s current limited purpose. Such mismatched identity and scope can cause users or agent frameworks to invoke unintended functionality and can mask capability creep that should have undergone separate review.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: The implementation fetches and returns full note details and author profile URLs, while the skill manifest says the skill should only retrieve comments, commenter information, and interaction data. This scope expansion can expose additional content and identifiers to downstream consumers without user expectation, creating a privacy and data-minimization violation. In this skill context, the mismatch is more dangerous because users may supply links expecting comment-only analysis, not collection of note-body and author-profile data.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The module comments and docstrings explicitly describe note-detail-and-comment behavior, contradicting the manifest's comment-only scope. This kind of documentation drift is security-relevant because it signals the code was designed for broader collection than the advertised capability, increasing the risk of unauthorized data access and misuse. In this context, the inconsistency undermines trust boundaries around what data the skill is supposed to process.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The code creates and queries endpoints for published posts using blogger URLs, which conflicts with the skill’s declared purpose of retrieving only comments for a specific note. This mismatch can cause over-collection of unrelated user/content data and may lead the agent to access broader profile/post information than users reasonably expect, creating a scope-creep and data-exposure issue.

Intent-Code Divergence

Medium

Confidence: 89% confidence
Finding: The module comments explicitly describe blogger details and published notes, directly contradicting the stated comment-only function of the skill. Such documentation/implementation drift is dangerous because it signals the module may intentionally or accidentally be used for broader data retrieval, increasing the chance of unauthorized collection and misleading reviewers about actual behavior.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The code performs keyword-based note search and constructs note/profile URLs, which materially exceeds the skill’s declared scope of only retrieving comments and commenter interaction data for a specific note. This kind of scope expansion can enable broader content discovery and user-profile enumeration than users or platform reviewers would expect, increasing privacy, compliance, and abuse risk.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The file header and function documentation explicitly describe a note search module, which contradicts the manifest’s comment-only purpose. This mismatch is dangerous because it signals undocumented capability drift: operators, users, or automated reviewers may trust the declared scope while the implementation supports broader data collection.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The skill metadata says this capability should retrieve only comment content, commenter information, and interaction data, but this CLI invokes a generic detail API and returns the entire detailTask object. That creates a scope mismatch: users and downstream systems may expect comment-only processing, while the implementation may expose full note details and other fields beyond the declared purpose.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The CLI writes the fetched result set to a local JSON file after returning it, which exceeds a retrieval-only expectation and creates an additional persistence surface for potentially sensitive third-party data. Local persistence increases the chance of unauthorized reuse, accidental disclosure, or retention beyond user intent.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The CLI schema and surrounding logic are built to accept a creator profile URL and fetch homepage posts, which directly contradicts the skill's declared purpose of retrieving comments for a specific note only. This mismatch is dangerous because an agent may collect a broader dataset than the user intended, causing unauthorized overcollection and privacy/compliance issues rather than a narrow comment-analysis operation.

Intent-Code Divergence

High

Confidence: 96% confidence
Finding: The inline documentation and help output explicitly instruct users to provide a creator profile link and describe returning homepage notes, reinforcing behavior that conflicts with the manifest's comment-only intent. In an agent setting, misleading docs increase the chance of unintended collection and misuse because operators may believe they are invoking a narrowly scoped comment-analysis tool when it actually performs broader profile scraping.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The implementation performs general keyword-based content search for notes, while the skill metadata says it should only retrieve comment content for a provided note link and not fetch note正文. That scope mismatch creates an unjustified expansion of capability and data access, which can enable broader collection of platform content than users or reviewers expect.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: This CLI accepts arbitrary keywords plus sort/type/time/limit parameters, enabling broad discovery of notes rather than narrowly analyzing comments on a known target. In the context of a comment-analysis skill, that extra search surface increases the risk of unauthorized data gathering, policy bypass, and user deception about what the skill actually does.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill states that every execution result is automatically archived under `logs/`, including timestamped keyword/link identifiers and returned data, but it does not prominently warn users about local persistence. Because queried URLs, search terms, and scraped results may contain sensitive research targets or personal data, silent disk retention increases privacy, leakage, and secondary-access risk.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: The README states that all task results are automatically saved to the logs/ directory, but it does not clearly warn that fetched comment data, commenter information, and engagement metrics will be persisted locally. In this skill's context, that increases the chance of unintended retention, secondary disclosure, and over-collection of scraped social-platform data beyond the user's expectations.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The CLI persists full comment results to disk via `log.taskWrite(...)` without any visible user warning or consent flow. Even if the source data is public, local persistence can create unintended retention of commenter information and interaction data, increasing privacy exposure on shared systems or developer workstations.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The program silently saves fetched detail data to a local file without clear disclosure at invocation time. Even if the data is already printed to stdout, undisclosed storage changes the privacy and security posture because users may not realize content and commenter data are being retained on disk.

Missing User Warnings

Medium

Confidence: 82% confidence
Finding: The command persists collected results to a local JSON file automatically, but there is no prominent disclosure or consent flow near the write operation. Because the skill handles scraped social-media data, silent local retention can create unnecessary exposure of potentially sensitive content, especially on shared systems or in agent execution environments with broad filesystem access.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.