Security audit

xhs-insight-generate

Security checks across malware telemetry and agentic risk

Overview

The skill does what it claims, but needs Review because it automatically stores fetched social-media results locally and sends tokens and query data through third-party API URL parameters.

Review before installing. Use this only if you are comfortable sending Xiaohongshu keywords, note/profile URLs, and a guaikei API token to the third-party service, and if local JSON logs of fetched results are acceptable in your environment. Treat the logs and API token as sensitive, especially on shared machines or managed workspaces.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The CLI writes fetched comment data to a local JSON file by default via log.taskWrite, creating a persistent copy of scraped public content without clear user consent or any retention controls. Even if the source data is public, comments may contain personal data or sensitive business intelligence, and local persistence increases exposure to unintended access, reuse, or leakage beyond the immediate task output.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The README states that all task results are automatically saved under `logs/`, but it does not clearly warn that user-supplied keywords, URLs, and returned content may be persisted to disk. In this skill’s context, those artifacts can reveal research targets, competitor monitoring activity, campaign strategy, or collected public-content datasets, creating confidentiality and retention risks on shared machines or managed environments.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The document instructs users to configure an external API token and run capabilities that search notes, fetch note details and comments, or collect creator post lists, but it does not disclose that those inputs will be transmitted to a third-party service. This creates a transparency and privacy risk because users may unknowingly send keywords, URLs, and potentially sensitive analytical targets to an external provider.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The code sends both the API token and search keyword in a GET request query object, which commonly places sensitive values into URLs. URLs are more likely to be exposed through browser history, proxy logs, server access logs, analytics systems, and monitoring tools, increasing the risk of token leakage and disclosure of user search terms.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: This file writes comment results to disk without any explicit warning in normal execution flow, so users may believe the tool only fetches and prints data while it is also creating local artifacts. In a data-collection skill focused on public notes and comments, undisclosed storage is more dangerous because it silently turns transient access into durable accumulation of potentially sensitive user-generated content.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The CLI writes the full search output, including user-provided keywords and returned results, to a local JSON file without any consent prompt, warning, retention control, or redaction. In an analytics/search skill, queries may reveal sensitive business research, personal interests, or investigation targets, and local persistence increases exposure to other users, backups, or later compromise of the host.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.