xhs-public-data-guaikei

• Outcome: Review
• Latest audit: Aug 11, 2026 · 2:13 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed Xiaohongshu public-data retrieval tool, but users should understand that it sends inputs to a third-party API and saves fetched results locally.

Install only if you are comfortable sending Xiaohongshu keywords or links, including possible xsec_token URL parameters, to guaikei.com with your GUAIKEI_API_TOKEN. Treat returned comments and profile data as public but still user-generated content, keep requests scoped, and periodically clean the local logs directory if you do not want datasets retained on disk.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (25)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The top-level metadata describes the skill narrowly as fetching a creator's public post list, but the body documents substantially broader capabilities including keyword search, note detail retrieval, and comment harvesting via multiple remote endpoints. This mismatch can defeat user/admin expectations, cause over-broad invocation, and lead to unintended collection/exfiltration of more data than the declared purpose suggests.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The manifest text limits the skill to public-post listing, while the documented operations clearly include broader content and comment retrieval. Security controls, user consent decisions, and automated routing may rely on the short manifest description, so this inconsistency creates a real transparency and scope-control problem.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The README positions the skill as a broad Xiaohongshu data-mining and marketing platform, while the manifest says it should only list a blogger's public works. This scope mismatch is dangerous because it can mislead users and downstream agents into invoking capabilities such as competitor monitoring, KOL screening, or bulk data extraction that were not declared or reviewed under the narrower manifest.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The README advertises keyword search, comment analysis, trend monitoring, and KOL screening that exceed the declared purpose of viewing a blogger's public posts. Even if technically limited to public data, undocumented feature expansion increases the risk of policy bypass, over-collection, and misuse in marketing surveillance contexts.

Intent-Code Divergence

High

• Confidence: 94% confidence
• Finding: The usage section presents multiple CLI entry points and use cases that frame the skill as a multi-function scraping/data platform rather than a narrow public-works reader. This increases operational risk because users or agent systems may rely on the README instead of the manifest and trigger higher-risk collection behaviors without clear consent, scope controls, or review.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The changelog documents functionality to retrieve comment information, which expands the skill beyond the manifest’s declared scope of only listing a creator’s public works. Scope drift is dangerous because users, reviewers, and policy controls may rely on the manifest to understand what data the skill accesses and exposes, leading to under-scoped review and unintended collection of additional public user data.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The changelog states the skill supports keyword search, note detail, and comment retrieval, which is materially broader than the manifest’s narrow description of creator public works listing. This mismatch can conceal the true operational surface of the skill, causing consumers and automated governance to permit a tool with more data-access and content-processing capability than advertised.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: Comment sentiment analysis is outside the declared purpose of creator work-list analysis and introduces an additional layer of processing on user-generated content. Even when comments are public, analyzing them changes the privacy and compliance posture of the skill and may trigger different policy, consent, and review expectations than a simple works-list tool.

Description-Behavior Mismatch

Low

• Confidence: 80% confidence
• Finding: The changelog indicates the skill was broadened into a general Xiaohongshu tool, which conflicts with the current single-purpose manifest. While this is weaker evidence than direct feature claims, it still suggests the documented and potentially implemented scope may exceed what downstream users and controls expect.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The documentation expands the skill from its declared purpose of fetching a creator’s public post list into four broader scraping/analysis capabilities, including keyword search and note/comment retrieval. This scope drift is dangerous because downstream agents may invoke undeclared data-collection behaviors the user and platform integrator did not authorize, increasing the chance of over-collection and policy noncompliance.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The note-detail and comment-analysis sections contradict the skill metadata stating it is not for broader audience/backend-style analysis and is intended for creator public works inspection. Even if the data is public, documenting comment harvesting and analysis broadens collection to user-generated audience data, which can cause unauthorized profiling or misuse beyond the approved purpose.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: This file implements comment-collection APIs, which materially exceed the skill’s declared scope of only retrieving a creator’s public works list. Scope mismatch is dangerous because it enables collection of additional public interaction data without clear user expectation, increasing the chance of over-collection, policy violations, and abuse of the skill for broader surveillance or profiling than advertised.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The module and function documentation explicitly describe a comment module, contradicting the published purpose of the skill. This inconsistency is a security-relevant transparency issue because hidden or undocumented functionality makes it harder for reviewers and users to understand what data the skill can access and increases the risk of deceptive data handling.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: This file clearly implements note-detail retrieval and comment collection, including creation and polling of a detail task with a caller-controlled comment limit up to 10000. That exceeds the declared skill scope of only listing a creator's public works, creating a scope-expansion/data-minimization issue that could expose more public-content metadata and comments than users would reasonably expect from this skill.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The CLI explicitly supports fetching note details plus comments via the --limit flag, which exceeds the stated skill scope of only retrieving a blogger's public works list. This creates a scope mismatch that can expose more data than users or integrators expect, especially because comments may contain third-party user content not implied by the manifest description.

Vague Triggers

Medium

• Confidence: 79% confidence
• Finding: The activation guidance encourages invocation even without an explicit user request for this specific skill, based on a broad heuristic like seeing a homepage link and inferred interest in posts. That can cause unintended third-party requests and unnecessary disclosure of user-supplied URLs/query tokens (`xsec_token`) to the external API provider, weakening informed consent and least-action principles.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The README states that all task results are automatically saved to the logs directory, but it does not clearly warn users that fetched platform data will be persisted locally. Silent persistence can create unintended data retention, leak sensitive business research, and expose collected public-content datasets to other local users or later compromise.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The document instructs collection of public content, note details, comments, and creator posts without any warning about privacy, platform terms, rate limits, or permissible data use. That omission is risky because operators may assume broad scraping and secondary analysis are acceptable, leading to avoidable compliance, privacy, or account-enforcement issues.

Missing User Warnings

Medium

• Confidence: 80% confidence
• Finding: The CLI sends the user-supplied note URL and limit to an external API via createCommentTask/getCommentTask without clearly warning the user that these parameters will leave the local environment. In this context, URLs can contain tracking or access-related query parameters such as xsec_token, so silent transmission can leak sensitive identifiers to a third party and surprise users about where their data is processed.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The tool persists fetched comment results to a local JSON file after successful execution, but it does not clearly disclose this storage behavior to the user. Comment datasets may contain personal or sensitive content, and unexpected local persistence increases the risk of accidental retention, later exposure, or misuse on shared systems.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The code sends the user-provided note URL and comment limit to an external API using GUAIKEI_API_TOKEN, but the CLI only states that the token must be configured and does not clearly warn that input will be transmitted to a third-party service. This can surprise users and cause unintentional disclosure of browsing targets or collection requests to an external processor.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The tool persists fetched details and comments to a local JSON file without explicit notice or a storage opt-in. Even if the source data is public, local persistence increases risk of unintended retention, secondary sharing, and exposure of collected comment content on shared systems or logs.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The CLI persists fetched Xiaohongshu post/profile results to a local JSON file automatically, but this file gives no explicit warning, consent prompt, retention control, or option to disable storage. Even though the data is described as public, automatic local persistence can create an unexpected privacy and data-handling risk by leaving scraped data on disk where other local users, processes, or logs may access it later.

Missing User Warnings

Medium

• Confidence: 78% confidence
• Finding: The program sends the supplied profile URL and query parameters to external API functions to create and fetch a scraping task, but this file does not clearly disclose that the input will be transmitted to a remote service. In a data-collection skill this network behavior is functionally expected, yet undisclosed transmission can still surprise users and may leak sensitive URL components such as xsec_token values embedded in the profile link.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The CLI persists full search results to a local JSON file using a filename derived in part from user input, without any visible opt-in or disclosure in this file. In the skill context, search results may contain collected public-content metadata that users may not expect to be retained on disk, increasing privacy, data handling, and local exposure risk on shared systems.

VirusTotal

63/63 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:16