Security audit

guaikei·小红书洞察

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Xiaohongshu public-data research tool that uses a Guaikei API token, sends queries and links to Guaikei, and saves results locally.

Install only if you are comfortable sending Xiaohongshu keywords, links, and retrieved public data to Guaikei using your GUAIKEI_API_TOKEN. Treat saved logs as potentially sensitive research output, delete them when no longer needed, and use the skill only for lawful, platform-permitted public-data analysis.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 78% confidence
Finding: The skill requires access to a sensitive environment variable (`GUAIKEI_API_TOKEN`) but does not declare permissions in a structured way, creating a transparency and governance gap. In agent platforms, undeclared secret usage can bypass user/admin expectations and increase the risk of accidental secret exposure, unauthorized external calls, or unsafe deployment assumptions.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The activation logic is overly broad: it says the skill should be used even when the user does not explicitly mention Xiaohongshu, as long as the context is general social-media research. That can cause misrouting of user requests, unintended transmission of user-provided data to an external service, and execution of a scraping-oriented workflow the user did not specifically request.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill prominently advertises searching/viewing/scraping Xiaohongshu data through a third-party API, but the main usage and activation sections do not provide a prominent user-facing warning that user inputs, keywords, and links will be transmitted to an external processor. This undermines informed consent and can expose sensitive research topics, proprietary monitoring targets, or personal data contained in URLs/comments to a third party.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The README states that all task results are automatically saved to a local logs directory, but it does not clearly warn users that scraped content, URLs, keywords, and analysis outputs will persist on disk. In a social-media intelligence context, this can expose potentially sensitive research targets, competitive monitoring activity, or collected public-comment datasets to other local users, backups, or later unintended disclosure.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: This section explicitly encourages pulling public notes, comments, and account-linked content for analysis without any accompanying privacy, consent, retention, or lawful-use guidance. Even though the data is described as public, large-scale collection and downstream profiling of comments or creator activity can create privacy, compliance, and misuse risks, especially when used for competitor monitoring or KOL screening.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The CLI writes full comment results to a local JSON file automatically, but does not clearly disclose this persistence behavior to the user or offer a way to opt out. Even though the data comes from public Xiaohongshu content, comments may still contain personal data or sensitive research targets, and silent local retention increases the risk of unintended exposure through shared machines, backups, or later exfiltration.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The CLI persists fetched Xiaohongshu results to a local JSON file automatically after successful execution, but the user-facing flow shown here does not clearly disclose that data will be written to disk. In a social-media research context, results may include comments, profile data, or other scraped public content that users may expect only on stdout; unexpected persistence increases privacy, retention, and local data exposure risk on shared systems.

VirusTotal

59/59 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:16