Security audit

xhs-campaign-monitor

Security checks across malware telemetry and agentic risk

Overview

This skill coherently provides public Xiaohongshu data lookup through a disclosed third-party API, but users should know results are saved locally and requests go to guaikei.com.

Install only if you are comfortable sending Xiaohongshu keywords, note/profile URLs, and the GUAIKEI_API_TOKEN-authenticated request to guaikei.com. Run it on a trusted machine because successful results are automatically saved in the skill's logs directory and may include competitive research terms, public profile data, comments, and note metadata.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The CLI writes full search results to a local JSON file using a filename derived from the searched keyword, but the tool behavior shown to users focuses on retrieval rather than persistent storage. Even though the content is public Xiaohongshu data, silently retaining query outputs can expose sensitive research interests, business intelligence, or collected profile data to other local users, backup systems, or later unintended processing.

Natural-Language Policy Violations

Medium

Confidence: 92% confidence
Finding: The code displays a hardcoded Chinese-only message instructing users to contact a specific WeChat number to obtain a private token when validation fails. This creates an inappropriate trust and support channel inside the skill, pressures users toward an off-platform contact path without consent, and can facilitate social engineering or unauthorized token distribution. In this skill context, which handles access tokens for a data collection tool, redirecting users to a private messaging contact is more suspicious because it bypasses normal credential provisioning and support processes.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The CLI writes the full fetched note detail payload to a local JSON file automatically, without opt-in, redaction, or visibility controls. Because this skill collects public note details and comments for analysis, the results may still contain sensitive business intelligence, user-generated content, or account-level research data that persists on disk and can be exposed to other local users, backups, or later compromise.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The CLI persists the full result payload to a local JSON file via log.taskWrite without clearly warning the user that output will be stored on disk. Because the payload includes request metadata and scraped results, this can unintentionally retain potentially sensitive operational data and create secondary exposure on shared systems or in later backups.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The code sends the user-supplied profile URL and token-authenticated requests to an external backend through post.createPostTask and post.getPostTask, but the user-facing help only mentions that an API token must be configured, not that the input data will be transmitted to a third-party service. This creates a transparency and data-handling risk, especially when users may assume the tool operates locally.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: Search outputs are persisted locally without any explicit warning, consent flow, or visible indication beyond internal code behavior. In this skill context, users may reasonably expect transient querying of public notes, not durable collection of result sets that can reveal monitoring targets, competitive analysis terms, and harvested content metadata.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.