Security audit

xhs-note-search

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed public Xiaohongshu data lookup skill that uses a third-party API and local result logs in ways that fit its stated purpose.

Before installing, confirm you are comfortable sending Xiaohongshu keywords or URLs plus a GUAIKEI_API_TOKEN to the Guaikei service, and periodically delete or protect the generated logs if the research topics or collected public comments are sensitive.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The CLI persists the full fetched result set to a local JSON file after completing a data-retrieval operation, but the user-facing behavior in this file does not clearly disclose that scraped content and request metadata will be written to disk. This creates unnecessary data retention risk because results may include sensitive operational research, and local files can be accessed by other users, backup systems, or later processes.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The CLI writes full search results to a local JSON file by default, which expands the skill from transient search into persistent data collection. This can expose sensitive business queries, collected content, or operator activity to other local users/processes without clear user consent or retention controls.

Missing User Warnings

Medium

Confidence: 78% confidence
Finding: The tool sends the user-provided profile URL together with an API token to backend functions that likely perform remote requests, but this file does not provide a clear runtime notice that user input and credentials will be transmitted to an external service. In a scraping/analytics context, that omission can mislead users about privacy boundaries and create data exposure risk, especially for research targets or account-linked URLs.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The code writes scraped results to a timestamped local JSON file without an explicit user warning or consent flow. Even if the data is publicly sourced, storing it silently increases privacy, compliance, and workstation data leakage risk because the saved file may persist longer than expected and be accessible outside the immediate CLI session.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: Search results are silently written to local storage without a user-facing warning, so users may reasonably believe the tool performs an ephemeral lookup when it actually creates a persistent audit trail. That hidden persistence can leak search terms, result content, and usage patterns on shared systems or developer workstations.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: The tool sends the user’s keyword and token-authenticated request to an external service, but the disclosure is limited to requiring an environment variable and does not clearly tell users that their query data leaves the local environment. For competitive analysis or business intelligence use cases, undisclosed outbound transmission of search terms can create confidentiality and compliance risks.

VirusTotal

57/57 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.