xhs-keyword-search

• Outcome: Pass
• Latest audit: Aug 9, 2026 · 3:58 AM UTC
• Version: 1.0.0

Overview

This skill appears to perform the public Xiaohongshu research tasks it describes, while using a third-party API token and saving returned results locally.

Install only if you are comfortable sending Xiaohongshu keywords or links to the Guaikei API using your GUAIKEI_API_TOKEN, and periodically review or delete the local logs directory because saved results can include search interests, public comments, profile/note URLs, and xsec_token query parameters.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: The top-level description says the skill performs keyword search, but the body also documents note-detail retrieval, comment harvesting, creator-profile monitoring, and local log writing. This mismatch can cause users or orchestrators to invoke the skill under incomplete assumptions, leading to broader data collection and local persistence than expected, especially when URLs and comment content may contain personal data.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The README advertises capabilities beyond the declared keyword-search scope, including note detail/comment analysis and creator post monitoring. Scope mismatch is dangerous because it can mislead users, reviewers, and policy controls about what the skill actually does, increasing the chance of unauthorized data collection or use outside approved expectations.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The documentation frames the tool as a broader data-mining, competitive-intelligence, and trend-monitoring platform rather than a narrow keyword-search skill. This overstatement creates a transparency and governance risk because users may grant trust or use the tool for more invasive collection than the published skill description permits.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The README claims comment-analysis functionality and even references non-Xiaohongshu comments, which is inconsistent with the stated keyword-search scope and suggests either undocumented data sources or careless copy/paste of cross-platform scraping claims. That mismatch is especially risky because comment harvesting can involve larger-scale collection of user-generated content and trigger privacy, compliance, and trust issues.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The changelog advertises capabilities that materially exceed the declared keyword-search scope, including note detail retrieval, comment sentiment analysis, and creator monitoring. This creates a transparency and trust problem: reviewers and users may approve or invoke the skill under a narrower understanding while the implementation may process additional data or perform broader scraping/monitoring actions than expected.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The documentation advertises three executable capabilities (keyword search, note detail/comments, and creator post retrieval) while the skill metadata claims only keyword search. This scope mismatch can cause callers, reviewers, or policy systems to grant trust or permissions based on an incomplete understanding of what the skill can do, enabling unreviewed data collection paths.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: This function creates a note-detail/comment retrieval task, which materially exceeds the declared skill scope of keyword-based public note search. Scope expansion is dangerous because agents or users may grant trust and permissions based on the manifest, while the implementation enables access to richer per-note and comment data than advertised.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The result processing reconstructs direct note and user profile URLs from IDs and xsec tokens, returning navigation targets beyond simple keyword-search results. This increases data exposure and capability drift: consumers expecting only search metadata can silently receive enriched links to specific content and profiles, undermining least surprise and least privilege.

Description-Behavior Mismatch

High

• Confidence: 91% confidence
• Finding: The file implements note-detail and comment retrieval plus local result logging, which exceeds the stated skill description of keyword search. This scope mismatch is dangerous because users or platform reviewers may grant trust based on a narrower manifest while the code processes additional content and persists it, increasing undisclosed data-collection behavior.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file implements a profile-post retrieval CLI that accepts a creator profile URL, while the declared skill is a keyword-based public note search tool with content-type, sort, and time-range filters. This mismatch can mislead users and downstream agents into sending different data than expected and relying on incorrect result semantics, which is a security-relevant integrity issue because the skill’s actual behavior diverges materially from its advertised contract.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The argument schema exposes only a profile URL and limit, but the manifest advertises keyword search plus multiple search filters and sort/time controls. This semantic discrepancy increases the risk of unsafe automation decisions, data handling mistakes, and unauthorized collection of profile-specific content under the false assumption that only keyword search is being performed.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The CLI persists full search output to a local JSON file even though the described skill behavior is just performing a search and returning results. This creates an undisclosed local data retention channel that may expose queried topics and returned content to other local users, backup systems, or later processes, especially because the filename also embeds the searched keyword.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The README states that all task results are automatically saved to the local logs/ directory without warning users about persistence, access control, or data handling. Even if the data is publicly sourced, automatic retention can expose scraped content, URLs, tokens embedded in links, or analysis outputs to other local users, backups, or accidental sharing.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The CLI writes fetched note/comment data to a local JSON file automatically after success, without clear prior warning or opt-in. Persisting scraped content can create privacy, compliance, and data-retention risks, especially if comments contain personal information or the host environment is shared.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill silently saves search results locally without a user-facing warning, confirmation, or explicit export option. Because the output may include sensitive search interests and scraped public content metadata, undisclosed storage increases privacy risk and may conflict with user expectations for a simple search command.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.