Security audit

guaikei·小红书看笔记

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed command-line tool for retrieving public Xiaohongshu data through a third-party API, with some privacy and retention considerations users should understand.

Install only if you are comfortable sending Xiaohongshu keywords or URLs, plus your GUAIKEI API token, to guaikei.com. Keep the token in an environment/secret manager, do not paste it into chats or repositories, and periodically clean the skill's logs directory if collected public posts or comments are sensitive to your work.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill requires an environment variable (`GUAIKEI_API_TOKEN`) and documents its use, but there is no clear declared permission model informing users that the skill consumes sensitive runtime configuration. This creates a transparency and review gap: operators may approve the skill without realizing it depends on privileged secret material and external API access.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The advertised purpose focuses on analyzing a blogger's public posts, but the documented behavior includes broader keyword search, standalone note detail/comment harvesting, and local log writing. This mismatch is dangerous because users and reviewers may authorize the skill under a narrower trust assumption while it actually supports wider data collection and persistence than the description suggests.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: Although the skill mentions dependency on a third-party API relay, it does not clearly warn that user-supplied note/profile URLs and retrieved platform data will be transmitted to `guaikei.com` during execution. That omission undermines informed consent and can expose potentially sensitive research targets, usage patterns, and collected content to an external processor.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The documentation instructs operators to configure a sensitive API credential (`GUAIKEI_API_TOKEN`) but gives no guidance on secure handling, storage, redaction, or avoidance of logging/sharing secrets. In agent environments, this increases the risk of accidental token disclosure through transcripts, screenshots, shell history, debug output, or misconfigured repositories, which could enable unauthorized use of the external service.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The CLI sends a user-supplied Xiaohongshu note URL and retrieves remote data via an external API, then writes the returned content to a local JSON file without an explicit user-facing notice or consent step about transmission and persistence. Because the data may include note details and comments tied to third-party accounts, this creates privacy, retention, and operational risk: users may unintentionally exfiltrate query targets to the service and leave durable local copies on disk.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The CLI writes the full collected results to a local JSON file after completion without any visible warning, consent, or option to disable persistence in this file. Because the output may include scraped profile content, comments, timestamps, and other collected data, this creates unintended local data retention and increases exposure if the host is shared, compromised, or logs are later exfiltrated.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The tool sends the supplied profile URL together with an API token to external post-task API functions, but this file does not clearly disclose the network transmission beyond a generic token requirement. In a scraping/analysis skill this is expected functionality, but it is still security-relevant because sensitive inputs and credentials are being transmitted to a backend service and users may not realize what leaves the local environment.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:16