Security audit

xhs-bloggertrack

Security checks across malware telemetry and agentic risk

Overview

This skill coherently fetches public Xiaohongshu search, note, comment, and blogger-post data through a disclosed third-party API, with local result logging that users should understand before use.

Install only if you are comfortable sending Xiaohongshu keywords, note URLs, profile URLs, and the GUAIKEI_API_TOKEN to the guaikei.com API. Review and delete the local logs directory as needed, especially on shared machines or when searches reveal business plans, competitor targets, or collected public comments.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The implemented CLI provides broad platform-wide keyword search, which exceeds the declared skill scope of fetching single-note comments or a blogger's public post list. This scope expansion is dangerous because it gives the agent undisclosed discovery capability that can be used for mass content reconnaissance, trend mining, or competitor surveillance beyond what users and reviewers would reasonably expect from the manifest.

Context-Inappropriate Capability

Medium

Confidence: 86% confidence
Finding: The argument schema explicitly exposes unrestricted keyword discovery controls such as keyword, type, sort, time, and large result limits, despite the stated purpose being limited to comments and blogger post lists. In an agent-skill context, unjustified search primitives increase the risk of hidden data gathering and policy bypass because the interface is designed for generalized reconnaissance rather than the documented narrow task.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The README states that all task results are automatically saved to the logs/ directory, but it does not clearly warn that sensitive work artifacts such as searched keywords, note URLs, profile URLs, and comment-analysis outputs may be persisted locally. In a marketing and competitor-analysis context, those artifacts can reveal business intent, research targets, and collected public data, creating avoidable confidentiality and data-retention risk on shared machines or improperly secured environments.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The document operationalizes collection of note details, comments, and competitor account post data, but provides no warning about privacy expectations, platform terms, consent boundaries, or downstream data handling. In a scraping/competitor-analysis skill, this omission can normalize bulk collection and secondary use of user-generated content without guardrails, increasing legal, compliance, and privacy risk.

Missing User Warnings

Medium

Confidence: 81% confidence
Finding: This CLI sends user-supplied note URLs and retrieves comment data from a remote API, then persists the full results locally via log.taskWrite without an explicit consent notice or a clear opt-in for storage. In a data-collection skill focused on scraping/public-content analysis, silent transmission and local retention increase privacy, compliance, and operational risk, especially if comments contain personal data or if logs are later exposed.

Missing User Warnings

Medium

Confidence: 80% confidence
Finding: The script persists full search output to a local JSON file using a filename derived in part from user input, without explicit consent or a clear retention notice. This creates a data-handling risk because potentially sensitive search queries and result sets may remain on disk, be accessible to other local processes or users, and accumulate beyond the user's awareness.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.