Security audit

guaikei·小红书搜索

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Xiaohongshu public-data lookup tool, with expected third-party API use and local result logging that users should be aware of.

Install only if you are comfortable sending Xiaohongshu search terms or URLs to guaikei.com with your GUAIKEI_API_TOKEN. Be aware that successful results are saved locally in logs, so clear that directory if the queries or collected public datasets are sensitive to your work.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The CLI persists fetched note-detail results to a local JSON file after completing a read-oriented operation, even though the skill description emphasizes returning structured public data rather than storing it. This creates an unnecessary data-retention surface: scraped content, comments, and metadata may remain on disk, be accessible to other local users/processes, or be collected by backups and logs without the operator realizing it.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The CLI persists fetched Xiaohongshu results to a local JSON file after already returning them to stdout. This creates an additional data sink not implied by the skill’s stated read/return-data purpose, increasing the risk of unintended retention, later disclosure to other local users/processes, or leakage of scraped content and associated metadata.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The trigger description is intentionally broad: it activates not only on explicit mentions of 小红书, but also on generic phrases like finding content, analyzing notes/comments, monitoring posts, and even related aliases/URLs. Overbroad routing can cause the agent to invoke this skill for unintended user requests, sending user-supplied keywords or links to a third-party API without clear user intent, creating privacy and data-handling risk.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The README states that all task results are automatically saved to a local `logs/` directory, but it does not clearly warn users that scraped public posts, comments, profile data, and queried keywords may be retained on disk. In a data-collection skill focused on competitor analysis and comment harvesting, this creates a real privacy and data-retention risk because sensitive research targets or collected datasets may persist longer than users expect and could be exposed to other local users, backups, or downstream sharing.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The code writes the full fetched detail payload to a local file without explicit notice or consent, so operators may believe the tool is only displaying transient results while it is actually retaining them. Even if the source data is public, comments and content datasets can still be sensitive in aggregate, and silent persistence increases the risk of accidental disclosure, over-collection, and policy noncompliance.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The code writes the full result payload to a local file without any user-facing notice in normal execution. Even if the content is public-source data, the output may include profile data, comments, URLs, and timestamps that users may not expect to be retained locally, creating a privacy and data-handling transparency issue.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:16