guaikei·小红书问评论

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:03 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed Xiaohongshu public-data retrieval tool, but users should understand it sends queries and URLs to guaikei.com and saves results locally.

Install only if you are comfortable sharing Xiaohongshu keywords, note/profile URLs, request metadata, and the API token with guaikei.com. Treat returned comments and creator data as public-but-sensitive, use the smallest practical limits, and clean the logs directory when results should not be retained.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (18)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The declared purpose understates the skill’s actual behavior: it can search content by keyword, fetch comments, enumerate a creator’s posts, send user inputs and retrieved data to a third-party service, and reportedly write results to local logs. This mismatch is dangerous because users and orchestration systems may invoke it without realizing that their prompts, URLs, and returned content are being transmitted externally and possibly stored locally, increasing privacy, compliance, and data-handling risk.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The README advertises capabilities far broader than the manifest’s stated purpose, including data mining, competitor monitoring, trend prediction, and bulk collection. This scope mismatch is dangerous because users and platform reviewers may authorize or run the skill under a narrower trust assumption than what the documentation suggests, increasing the risk of misuse, overcollection, and policy noncompliance.

Description-Behavior Mismatch

Low

• Confidence: 84% confidence
• Finding: The README claims automatic result saving, batch operations, multi-format export, and log archival behavior not disclosed in the manifest’s limited analytics description. Undisclosed persistence is risky because collected target URLs, keywords, and analysis outputs may be retained locally without user awareness, creating avoidable data retention and leakage risks.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The README introduces trend prediction and hot-topic monitoring capabilities that exceed the manifest’s engagement-audit framing. In this context, the issue is more concerning because the skill is positioned as a KOL evaluation tool, yet the documentation suggests broader surveillance and monitoring use cases that may alter user consent expectations and operational risk.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: This CLI fetches and returns raw comment data for a note, which goes beyond the manifest’s described purpose of assessing engagement quality via real like/comment/favorite metrics. Even if the comments are publicly accessible, collecting and operationalizing full comment content expands the data scope and creates privacy and purpose-limitation risk, especially when used for creator profiling at scale.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The tool persists fetched comment results to a local JSON file after retrieval without any visible necessity tied to the stated purpose. Storing comment content increases data retention risk, may leave sensitive or personal information on disk, and broadens exposure if the host environment is shared, backed up, or later compromised.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The CLI writes the full fetched note-detail output to a local JSON file after completing the request, creating persistent storage of scraped content and engagement data beyond the immediate user-visible response. In a skill whose stated purpose is to return public engagement metrics for evaluation, this hidden retention increases data exposure risk on shared hosts, developer machines, or agent runtimes where logs may be collected, synced, or later accessed by unrelated users or processes.

Context-Inappropriate Capability

Low

• Confidence: 84% confidence
• Finding: The CLI writes fetched creator-note results to a local JSON file automatically, creating persistent data at rest without clear necessity or user awareness in this file's interface. Even if the source data is public, saving structured engagement data locally can increase privacy, retention, and secondary-use risk, especially on shared systems or when filenames reveal the target account.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The activation language is broad enough to trigger on many ordinary requests about Xiaohongshu engagement, which can cause the agent to invoke an external-data skill unexpectedly. In context, that matters because execution sends user inputs to a third-party API, so overbroad routing increases the chance of unnecessary data disclosure and unintended tool use.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The listed trigger phrases are common, everyday requests and do not sufficiently constrain when the skill should run. Because the skill relies on a third-party service, ambiguous triggers can lead to unnecessary outbound requests and collection of public-but-still-sensitive engagement or comment data without clear user awareness.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill mentions third-party API relay in general terms but does not clearly warn that user-supplied Xiaohongshu URLs, keywords, and retrieved content are transmitted to an external service during execution. This is dangerous because users may provide potentially sensitive research targets or analysis subjects without informed consent to external sharing, creating privacy, confidentiality, and compliance risk.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The README instructs users to obtain and configure a third-party API token but does not warn that keywords, note URLs, and profile URLs will be transmitted to an external service. This is dangerous because operationally sensitive research targets and query terms may leave the local environment without informed consent, exposing user intent, monitoring subjects, or business intelligence to the provider.

Missing User Warnings

Medium

• Confidence: 80% confidence
• Finding: The documentation encourages fetching public notes, comments, and creator posts at scale, including up to very large limits, but does not include any privacy, retention, or responsible-use guidance. Even when data is publicly accessible, bulk aggregation and analysis can create privacy and compliance risk, especially if comments contain personal information or are reused for profiling or monitoring.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The CLI writes comment results to a local file without any user-facing disclosure in this file that persistence will occur. Hidden storage undermines informed consent and can surprise operators who expect transient processing, increasing privacy and compliance risk for scraped social-media data.

Missing User Warnings

Medium

• Confidence: 76% confidence
• Finding: The code sends the provided note URL and API token to a remote service to create and retrieve comment tasks, but there is no explicit privacy or data-transfer disclosure here. While network transmission is expected for an API-backed skill, the absence of notice is risky because users may not realize note identifiers and access credentials are being shared with an external backend.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The code silently saves fetched note details to disk without any explicit warning, consent flow, or user-controlled toggle. Even if the source content is public, the persisted output can include compiled data, comments, and metadata that users may not expect to remain on disk, which raises privacy, compliance, and operational security concerns in automated environments.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The command persists fetched results to a local JSON file but does not clearly warn the user beforehand in the CLI flow shown here. This can expose collected creator data to other local users, backups, sync tools, or later unintended processing, making the persistence behavior more dangerous than transient stdout output.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The CLI writes full search results to a local JSON file automatically, without explicit user consent or a clear warning. In shared environments, CI runners, agent sandboxes, or multi-user systems, this can create unintended persistence of potentially sensitive browsing/query history and retrieved content, increasing the risk of later disclosure through logs, workspace artifacts, or backup/sync systems.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:16