Security audit

guaikei·小红书竞品监控

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed public Xiaohongshu data-analysis skill, but it sends requests through GuaiKei and saves fetched results locally.

Install only if you are comfortable sending Xiaohongshu keywords or URLs to GuaiKei with your GUAIKEI_API_TOKEN. Treat the token as a secret, do not echo or paste it into chats/logs, and review/delete the local logs directory when results include comments or other third-party public content you do not need to retain.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (18)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: The public description narrows the skill to competitor-watch/profile-post use, but the body instructs the agent to perform broader platform search, note detail retrieval, and comment extraction. This mismatch can cause the skill to be invoked in contexts the user did not expect, weakening consent boundaries and increasing the chance of over-collection or misuse of third-party data.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The package metadata advertises capabilities such as user profiling, KOL screening, precise marketing, and broader data mining/trend monitoring that exceed the stated skill purpose of listing a creator's public posts. This scope mismatch is dangerous because it can mask feature creep or enable operators to collect or infer more data than users expect, undermining informed consent and making downstream misuse of analytics features more likely.

Description-Behavior Mismatch

High

Confidence: 93% confidence
Finding: The README advertises capabilities far beyond the manifest’s stated purpose of listing a blogger’s public works, including trend prediction, KOL screening, comment analysis, and broad data mining. This scope expansion is dangerous because users, reviewers, or downstream agents may invoke or trust the skill for higher-risk collection and profiling tasks that were not declared, weakening least-privilege and policy enforcement.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: KOL screening and trend prediction introduce profiling and surveillance-style analytics that are not justified by the narrow declared function of viewing a creator’s public works list. In skill ecosystems, such undocumented analytical expansion can enable misuse of public data for ranking, targeting, or behavioral inference without appropriate review or user expectation.

Intent-Code Divergence

High

Confidence: 91% confidence
Finding: The usage examples and scope statements describe operations such as keyword monitoring, note-detail retrieval, and comment analysis that contradict the manifest’s narrower intent. This inconsistency is dangerous because agents may follow the README as the operational truth, causing the skill to be used for broader data access and monitoring than reviewers or users authorized.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The changelog documents capabilities such as comment retrieval and sentiment analysis that go beyond the manifest’s declared scope of listing a blogger’s public works. This scope drift is dangerous because downstream agents, reviewers, or users may rely on the manifest for trust and consent decisions while the skill actually supports broader data collection and analysis behavior.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The changelog indicates keyword search functionality that does not match the manifest’s narrowly described purpose of blogger-works monitoring. Undocumented feature expansion increases the risk of unauthorized or unexpected collection workflows, and can bypass policy gating that is based on the declared skill purpose.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: This file implements comment collection for Xiaohongshu notes, which goes beyond the skill’s stated purpose of listing a creator’s public works and identifying which posts performed well. Scope expansion matters because comments can contain additional user-generated content and personal data, increasing privacy and compliance risk beyond what a user would reasonably expect from this skill.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The file implements comment collection for a specific note, while the declared skill purpose is monitoring a creator's public works list. This capability expansion is security-relevant because comments may contain third-party user content and metadata that are outside the stated scope, increasing privacy and data-handling risk and making it easier to collect unrelated user-generated data under a misleading skill description.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The code actively creates and retrieves a comment task even though the skill's stated purpose is creator works monitoring, not comment analysis. That mismatch weakens least-privilege and purpose-limitation guarantees, enabling collection of additional public but potentially sensitive third-party content without clear justification in the skill context.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The CLI schema and help text explicitly support fetching a single note's details and comments, which exceeds the stated skill purpose of listing a creator's public works and identifying posting cadence/popular posts. This scope expansion increases data collection beyond the user's likely expectation and can enable access to and storage of comment data unrelated to the advertised competitor-watch function.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The `--limit` flag and surrounding descriptions show the tool is designed to retrieve comments, a capability not justified by the narrow competitor-watch/listing description. Even if the comments are public, collecting them materially broadens surveillance and data processing scope, creating a privacy and trust issue through functionality mismatch.

Description-Behavior Mismatch

High

Confidence: 94% confidence
Finding: The implementation is a generic keyword search CLI for Xiaohongshu content, which materially exceeds the stated skill purpose of viewing a specific blogger's public works list. This capability broadening increases abuse potential for broad discovery, monitoring, or targeting workflows that users and reviewers would not expect from the manifest, undermining least-privilege and trust boundaries.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The exposed flags and schema enable broad content discovery by arbitrary keyword, type, sort, time, and limit, which is not necessary for the declared competitor-watch use case. Even if the data is public, overbroad capability creates a policy and security mismatch that can facilitate unintended surveillance or mass content enumeration.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The instructions tell operators to export an API token and even suggest checking it with shell commands, but they do not clearly warn that the credential is sensitive or prohibit exposing it in logs, transcripts, or user-visible output. In agent or shared-shell environments, this increases the risk of accidental token disclosure and downstream unauthorized API use.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The CLI writes fetched comment results to a local JSON file automatically, without any notice, confirmation, or retention control in this file. Persisting scraped third-party content increases exposure through accidental disclosure, over-retention, or later reuse of data beyond the user's immediate request.

Missing User Warnings

Medium

Confidence: 82% confidence
Finding: The code sends the user-supplied note URL together with `GUAIKEI_API_TOKEN` to external API functions without any explicit runtime disclosure that data will be transmitted to a third-party service. In the context of a skill advertised as simple public-work listing, this hidden network transfer can mislead users about where their inputs go and what service processes them.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The tool persists the full result payload, including note details/comments, to a local JSON file via `log.taskWrite` without clearly informing the user that data will be stored on disk. Silent persistence increases the chance of unintended retention, later disclosure, or access by other local users/processes, especially because comment content may be more sensitive than the manifest suggests.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:16