Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed Xiaohongshu public-data lookup skill, but it uses a third-party API token and automatically saves returned data locally.
Install only if you are comfortable sending Xiaohongshu keywords, note/profile URLs, and returned public-content data to guaikei.com using your GUAIKEI_API_TOKEN. Treat the generated logs as potentially sensitive, especially URLs containing xsec_token values, and clean or protect the logs directory on shared machines.
src/validate/url.js:3Bypassable URL Allowlist Permits Attacker-Controlled URLs
src/utils/log.js:24Sensitive Xiaohongshu Links and API Results Are Persisted with Default File Permissions
The documentation advertises automatic log archival and the static finding indicates local filesystem writes, yet the permission scope is not clearly declared. Undocumented or under-scoped file output can create privacy and security risks by storing queried URLs, returned content, or API-related metadata on disk where other users or processes may access it.
The documentation advertises automatic log archival and the static finding indicates local filesystem writes, yet the permission scope is not clearly declared. Undocumented or under-scoped file output can create privacy and security risks by storing queried URLs, returned content, or API-related metadata on disk where other users or processes may access it.
The documentation advertises automatic log archival and the static finding indicates local filesystem writes, yet the permission scope is not clearly declared. Undocumented or under-scoped file output can create privacy and security risks by storing queried URLs, returned content, or API-related metadata on disk where other users or processes may access it.
The documentation advertises automatic log archival and the static finding indicates local filesystem writes, yet the permission scope is not clearly declared. Undocumented or under-scoped file output can create privacy and security risks by storing queried URLs, returned content, or API-related metadata on disk where other users or processes may access it.
The documentation advertises automatic log archival and the static finding indicates local filesystem writes, yet the permission scope is not clearly declared. Undocumented or under-scoped file output can create privacy and security risks by storing queried URLs, returned content, or API-related metadata on disk where other users or processes may access it.
The documentation advertises automatic log archival and the static finding indicates local filesystem writes, yet the permission scope is not clearly declared. Undocumented or under-scoped file output can create privacy and security risks by storing queried URLs, returned content, or API-related metadata on disk where other users or processes may access it.
The documentation advertises automatic log archival and the static finding indicates local filesystem writes, yet the permission scope is not clearly declared. Undocumented or under-scoped file output can create privacy and security risks by storing queried URLs, returned content, or API-related metadata on disk where other users or processes may access it.
The documentation advertises automatic log archival and the static finding indicates local filesystem writes, yet the permission scope is not clearly declared. Undocumented or under-scoped file output can create privacy and security risks by storing queried URLs, returned content, or API-related metadata on disk where other users or processes may access it.
Referenced artifact was not completely inspected
- "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Referenced artifact was not completely inspected
- "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Referenced artifact was not completely inspected
- "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Referenced artifact was not completely inspected
- "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Referenced artifact was not completely inspected
- "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Referenced artifact was not completely inspected
- "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
The implementation in this file performs blogger-profile and published-post retrieval via /api/xiaohongshu/post/url and /api/xiaohongshu/post/info, which does not match the declared skill purpose of keyword-based public note search. This capability mismatch is dangerous because it can cause users, reviewers, or downstream agents to invoke broader or different data access than intended, undermining trust boundaries and potentially enabling collection of profile-related content outside the advertised scope.
The manifest describes a skill whose purpose is keyword-based Xiaohongshu public note search with filters and sorting, but this file implements a different operation: given a note URL, it creates and retrieves a comment/detail task and returns note/comment details. This is a substantive behavior expansion beyond search, not just an implementation detail of searching.
The CLI schema and help text define the tool as accepting a creator profile URL and fetching that profile's posts, which materially conflicts with the manifest claiming keyword-based Xiaohongshu search. This kind of capability mismatch is dangerous because users and downstream agents may grant access or trust results under false assumptions, causing unintended collection of profile-specific data and policy bypass through deceptive packaging.
The core execution path creates and retrieves a 'post' task using a profile URL and limit, confirming the skill performs profile-post retrieval instead of keyword search. In an agent setting, this is a security-relevant deception issue because it can make reviewers and users believe the tool has narrower or different data-access behavior than it actually does.
The skill declares access to a sensitive environment variable (GUAIKEI_API_TOKEN) but does not declare any explicit tool scope or permission boundary. That weakens least-privilege guarantees and makes it harder for a host agent or reviewer to understand what the skill is allowed to access, increasing the chance of unintended secret exposure or overbroad execution.
The package metadata uses Chinese-only natural-language description and keywords, which indicates the skill is presented in a single language without any visible opt-in or multilingual alternative. Under the policy rule, forcing a specific language or locale without user choice or a documented justification is a natural-language policy concern.
The README specifically claims comment-analysis and comment-detail retrieval, which exceeds the stated keyword-search purpose of the skill. In a scraping/data-analysis context, undeclared comment collection is more sensitive because it expands the type and volume of scraped public content and may create compliance, privacy, and review gaps.
The README advertises capabilities beyond the declared keyword-search scope, including note detail/comment analysis and creator monitoring. This scope mismatch can mislead users, reviewers, and downstream agents about what the skill actually does, reducing transparency and increasing the chance that broader data collection features are used without proper review or authorization.
The README states that all task results are automatically saved to the logs directory, but does not clearly disclose that those files may contain scraped URLs, keywords, interaction metrics, or analysis outputs. Automatic persistence of scraping results increases the risk of unintended local data retention, leakage to other users/processes, and accidental redistribution of collected data.
The changelog advertises capabilities materially broader than the declared skill scope, including note-detail retrieval, comment sentiment analysis, and creator-work monitoring. This scope drift can mislead reviewers and users about what data the skill may access or process, weakening trust boundaries and increasing the chance of undisclosed data collection or higher-risk downstream behavior.
The documentation advertises three operational capabilities—keyword search, note detail/comment retrieval, and creator post retrieval—while the manifested skill metadata only declares keyword search. This scope mismatch can cause callers, reviewers, or policy layers to underestimate what the skill can do, enabling unreviewed data access paths and broader collection of public content than expected.