guaikei·小红书搜索·详情·评论·博主作品

• Outcome: Review
• Latest audit: Aug 16, 2026 · 2:54 AM UTC
• Version: 1.0.0

Overview

This skill coherently provides Xiaohongshu public-content data retrieval through a disclosed third-party API, with notable but disclosed token, network, and local logging behavior.

Install only if you are comfortable sending Xiaohongshu search terms, note/profile URLs, requested limits, and your GUAIKEI_API_TOKEN to guaikei.com. Expect full results, including comments and identifiers, to be saved under the skill's logs directory; delete or protect those logs when handling sensitive research, and use the tool only for public data in line with platform terms and applicable privacy rules.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence
• Finding: The skill requires the sensitive environment variable `GUAIKEI_API_TOKEN`, but the document does not declare permissions in a structured way despite clearly depending on env access. This weakens security review and user awareness, because the skill can consume credentials and send data to a third-party service without an explicit permission declaration boundary.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The claim of 'no risk control risk' conflicts with later statements about authentication failures, rate limits, and third-party API errors. Misleading safety language can cause operators to underestimate compliance, detection, or abuse risks when using the skill for large-scale scraping of platform content.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The CLI advertises structured JSON output for Xiaohongshu retrieval, but it also silently persists the full result set to a local file whose name includes the user's keyword. That creates an undisclosed data-retention channel for potentially sensitive research terms and scraped content, which can later be exposed to other local users, backup systems, or unintended tooling.

Vague Triggers

High

• Confidence: 93% confidence
• Finding: The activation rule is overly broad: it instructs invocation even when the user did not explicitly ask to search Xiaohongshu, as long as intent is inferred. This creates a prompt-scope vulnerability where the agent may exfiltrate user queries, URLs, or research targets to an external service without clear consent or necessity.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill states that every execution is automatically archived to local log files containing timestamps and keyword/link identifiers, but does not prominently warn users about this persistence. This can expose sensitive research terms, tracked profiles, or note URLs to unintended local readers, backups, or later processes.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The README states that all task results are automatically saved to a local `logs/` directory, but it does not clearly warn users that fetched note content, comments, searched keywords, and target URLs may be persisted on disk. For a data-collection skill, this creates a real privacy and operational security risk because sensitive research targets, monitoring activity, or regulated personal data from public comments may be retained longer than users expect and exposed to other local users, backups, or log shipping systems.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The documentation explicitly supports large-scale retrieval and analysis of public notes, comments, and creator activity, including sentiment analysis, opinion clustering, and monitoring, but it does not provide any privacy, retention, consent, or lawful-use guidance. Even when data is publicly accessible, aggregating up to 10,000 items and structuring comment data materially increases privacy and profiling risk, especially for surveillance, competitor intelligence, or KOL monitoring workflows.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The CLI writes the full comment task output to a local JSON file after execution, but the user-facing flow does not clearly warn that fetched content will be persisted on disk. Because this skill collects social-content data and comments that may contain personal data, local persistence can create unintended data retention, expose sensitive content to other local users/processes, and increase compliance/privacy risk if logs are later copied or backed up.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The CLI writes the full fetched note details and comments to a local JSON file via log.taskWrite, which can persist potentially sensitive or regulated third-party content on disk without an explicit warning, consent checkpoint, or retention control in this file. In the context of a scraping/export skill, silent local persistence increases the risk of unintended disclosure through shared machines, backups, logs, or later reuse beyond the user's immediate task.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: Search results are written to disk without a clear user-facing warning, which means user queries and collected Xiaohongshu data persist beyond the session. Because the filename embeds the search keyword, even metadata about what the user searched for is leaked into the filesystem, increasing privacy and compliance risk in shared or monitored environments.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:17