Security audit

xhs-look-note-guaikei

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed Xiaohongshu public-data retrieval tool; the main risks are third-party API use and automatic local result logs, not hidden or destructive behavior.

Install only if you are comfortable sending Xiaohongshu keywords, note links, creator profile links, and related public-content results to guaikei.com using your GUAIKEI_API_TOKEN. Treat the token as a secret, confirm ambiguous requests are really about Xiaohongshu, and periodically delete artifact/logs if retained research targets or comments should not remain on disk.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (21)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill requires an environment secret (`GUAIKEI_API_TOKEN`) but does not declare corresponding permissions, which weakens transparency and governance around sensitive capability use. In practice this can bypass user/operator expectations about what privileged resources the skill needs and make secret handling harder to audit.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The top-level description says the skill is for keyword-based Xiaohongshu note search, but the body also supports fetching note details, comments, and creator profile posts by URL. This mismatch can cause an orchestrator or user to invoke the skill in situations where they would not have consented to broader data collection or external transmission, increasing privacy and policy risk.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The README advertises capabilities beyond the skill metadata and stated scope, including note details, profile monitoring, and comment analysis. This can cause operators or downstream agents to invoke the skill for broader data collection than users were told to expect, creating a transparency and misuse risk even if the underlying data is public.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The documentation claims competitor monitoring, KOL screening, comment analysis, and trend prediction, which materially expands the apparent surveillance and profiling scope beyond the metadata description. Scope inflation is dangerous because it obscures the true behavior of the skill and can enable unreviewed collection or analysis workflows under a narrower declared purpose.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The changelog advertises capabilities beyond the manifest’s declared scope, including comment retrieval, note details, routing behavior, and creator-monitoring related workflows. Scope drift is dangerous because reviewers, users, and policy controls may rely on the manifest to understand what the skill can access and do; undocumented capabilities can bypass informed consent, safety review, or least-privilege expectations.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The changelog states the skill can monitor or scrape a creator’s works, which is materially broader than the manifest’s search-oriented description. This mismatch increases risk because monitoring functionality may enable profile tracking or bulk collection behavior that operators and users did not authorize under the declared scope.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The changelog records note-detail retrieval and comment sentiment analysis, which exceed the manifest’s stated keyword-search behavior. Hidden analytical features can change the privacy and compliance posture of the skill by expanding data processing beyond what downstream consumers expect or what prior review covered.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The documentation advertises note-detail, comment, and author-post retrieval capabilities that go beyond the skill metadata’s stated keyword-search scope. This mismatch can cause an orchestrator or user to invoke broader data collection than intended, increasing the chance of over-collection, policy bypass, or use of the skill in contexts that were not reviewed or approved.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The file implements comment-task creation and retrieval against Xiaohongshu endpoints, while the declared skill scope is limited to public note search, popularity analysis, and does not mention comment harvesting. This scope expansion matters because comments can contain additional user-generated content and metadata, increasing collection breadth beyond what users and reviewers would reasonably expect from the manifest.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The file implements note-detail and comment retrieval endpoints, which exceeds the declared skill scope of keyword-based discovery of public notes and engagement metrics. This scope expansion is dangerous because it enables collection of richer per-note and per-user data than users or platform reviewers would expect, increasing privacy, compliance, and misuse risk even if the content is publicly accessible.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: The implementation exposes blogger-profile and published-note retrieval APIs while the skill manifest claims the skill performs keyword-based search of public notes. This capability mismatch can cause the agent to access and return a different class of data than the user and platform reviewers expect, undermining consent, policy review, and least-privilege assumptions. In a social-media research skill, hidden author-centric collection is more privacy-sensitive than generic keyword search because it enables targeted profiling of specific accounts.

Intent-Code Divergence

Medium

Confidence: 89% confidence
Finding: The file-level comments and function documentation explicitly describe blogger-detail and published-note collection, contradicting the manifest's stated keyword-search purpose. Documentation mismatches are security-relevant here because they indicate undeclared functionality and increase the risk that reviewers, downstream agents, or users misunderstand what data is being accessed and why. In this skill context, that makes covert expansion from content discovery to account-focused scraping more plausible and more dangerous.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The code behavior materially contradicts the skill manifest: it accepts a creator profile URL and fetches homepage posts rather than searching public notes by keyword. This creates a scope/intent mismatch that can mislead users and orchestrators into sending different data than expected, undermining trust boundaries and potentially causing unintended collection of profile-specific content.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The help text repeatedly states that the command operates on a Xiaohongshu blogger/profile link, which conflicts with the published skill description of keyword-based public note search. Misleading documentation is a security-relevant integrity issue because users may disclose or authorize different data flows than they intended based on incorrect capability descriptions.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The description contains broad trigger phrases like '最近什么火' and '帮我找热门内容' that allow the skill to match generic social-media research requests even when Xiaohongshu is not explicitly requested. Over-broad routing can silently send user queries to this skill and its third-party backend in contexts the user did not intend.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The documentation notes that data is sent through a third-party API, but this warning appears late and not before the operational instructions and examples. Users may provide keywords, note URLs, profile URLs, and potentially sensitive research targets without clear advance notice that these inputs will be transmitted externally.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: Automatically saving task results to logs/ can persist searched keywords, analyzed URLs, note content, and comment-derived data on disk without clear warning or retention controls. In a social-media intelligence context, this increases the chance of unintended exposure of sensitive research targets, monitoring subjects, or collected public data through local compromise, backups, or shared environments.

Missing User Warnings

Low

Confidence: 81% confidence
Finding: The document instructs users to configure GUAIKEI_API_TOKEN but does not warn that it is a sensitive secret that must not appear in logs, screenshots, prompts, or shared outputs. In agent environments, missing secret-handling guidance can lead to accidental credential disclosure during setup, debugging, or transcript sharing, enabling unauthorized API use.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The CLI persists fetched comment data to a local file without any explicit opt-in, warning, retention control, or redaction. Even if the source content is public, storing comments locally can increase privacy exposure, create unintended data retention, and leak sensitive user-generated content through shared disks, backups, or logs.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The script persists fetched note details and comments to a local JSON file automatically, without opt-in or warning. This can unintentionally retain scraped content, metadata, and potentially sensitive user-requested material on disk, increasing exposure through local compromise, backup leakage, or accidental sharing.

Missing User Warnings

Low

Confidence: 88% confidence
Finding: The skill persists fetched results to a local JSON file without prior disclosure or an opt-in mechanism. Even if the data is public, silent retention can create privacy and data-governance issues, especially in shared environments where output files may be accessible to other users or processes.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:16