Security audit

xhs-note-detail

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent Xiaohongshu public-data lookup tool, but users should understand that results and tokenized URLs may be sent to a third-party API and saved locally.

Install only if you are comfortable sending Xiaohongshu keywords or links, including possible xsec_token URL parameters, to guaikei.com with your GUAIKEI_API_TOKEN. Treat generated logs as potentially sensitive because they may contain searched topics, public comments, profile data, and tokenized URLs; delete or protect the logs directory when sharing the workspace.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The CLI writes the full result payload, including fetched note/comment data and request metadata, to a local JSON file without any explicit disclosure or consent in the described skill behavior. For a data lookup/detail tool, this creates an unnecessary persistence channel that can expose scraped content, URLs, and potentially sensitive operational data to other local users, backup systems, or later unintended reuse.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The README states that all task results are automatically saved to the logs/ directory, but it does not clearly warn users that scraped URLs, comments, profile data, or analysis outputs may persist on disk. In a data-collection skill, silent persistence increases the risk of unintended retention, local disclosure, and secondary misuse of collected public-but-sensitive marketing or user-content data.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The documentation explicitly encourages passing full Xiaohongshu URLs, including query-token-bearing links such as `xsec_token`, into local scripts and potentially onward to an external service, but provides no warning that these links may contain sensitive or session-like access parameters. This can lead users to unnecessarily disclose tokens in logs, shell history, transcripts, or third-party processing pipelines, increasing the risk of unintended access or tracking.

Missing User Warnings

Low

Confidence: 84% confidence
Finding: The file instructs users to configure `GUAIKEI_API_TOKEN` but does not include any warning about secure storage, least exposure, or avoiding accidental disclosure in terminal history, screenshots, logs, or shared environments. While documenting an environment variable is common, omitting basic handling guidance can contribute to credential leakage through operational mistakes.

Missing User Warnings

Medium

Confidence: 78% confidence
Finding: The tool silently writes search results and query metadata to a local file without explicit user-facing notice or consent. Even though the searched content is public Xiaohongshu data, the saved file can reveal the operator's interests, targets, and analysis activity to other local users or later processes on the same machine.

VirusTotal

50/50 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.