Security audit

guaikei·小红书笔记搜索

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Xiaohongshu public-data retrieval tool that uses a third-party API and saves results locally, with privacy and credential-handling caveats users should understand.

Install only if you are comfortable sending Xiaohongshu links, keywords, and the GUAIKEI_API_TOKEN to Guaikei, and with full returned results being saved under the skill's logs directory. Avoid using sensitive competitor research terms on shared machines unless you manage log retention and local file access.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The CLI writes the full fetched detail result to a local file after completing the task, which expands the skill from transient data retrieval into persistent storage of note and comment content. In a data-collection skill, this increases privacy and data-retention risk because users may not expect harvested social content to remain on disk after execution.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The code stores the entire detail-task output, including potentially large amounts of note and comment data, to a local JSON file without demonstrating necessity for the stated purpose of 'only getting data'. Persisting full result sets can expose scraped content to later unintended access, backup leakage, or reuse beyond the original user request.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The trigger language is broad enough that the skill may activate in loosely related 'data-driven decision' scenarios even when the user did not clearly request Xiaohongshu data retrieval. Over-broad activation can cause unintended third-party data transmission, unnecessary token-backed API use, and collection of public profile/comment data without sufficiently explicit user intent.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill processes author and commenter data through a third-party API but does not clearly warn the user at execution time that links, keywords, and retrieved public data may be sent off-platform. This can create privacy, compliance, and consent issues, especially where users may assume the assistant is only performing local analysis rather than external data retrieval.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The README explicitly states that all task results are automatically saved to a local logs/ directory, but it does not warn users that searched keywords, fetched URLs, comment data, and analysis outputs may persist on disk. Because this skill processes marketing research and public-platform content at scale, those local artifacts can expose sensitive business interests, monitored competitors, or collected content to other local users, backups, or downstream tooling.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The GET request places the token and URL into request query parameters, which are more likely to be exposed via server logs, proxy logs, browser/network tooling, and monitoring systems than request bodies or authorization headers. For an API token, this increases the chance of credential leakage and unauthorized reuse if infrastructure or observability systems capture full URLs.

Missing User Warnings

Low

Confidence: 83% confidence
Finding: The code sends both the API token and the user search keyword in a GET request query object. Query parameters are more likely to be captured in access logs, browser/proxy history, monitoring systems, or intermediary infrastructure, which can leak credentials and potentially sensitive search terms; in a data-collection skill, user queries may include commercially sensitive research targets, making this somewhat more dangerous in context.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The CLI writes retrieved detail data to a local JSON file without warning the user at the time of execution, creating an undisclosed persistence behavior. In a social-data scraping context, silent local retention can increase privacy, compliance, and data exposure risk, especially on shared systems or developer workstations.

Missing User Warnings

Low

Confidence: 75% confidence
Finding: The CLI writes full search output, including the user keyword and returned results, to a local file without explicit consent or a clear warning at execution time. This can create unintended data retention and expose potentially sensitive research terms or collected content to other local users, backups, or log aggregation processes.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:15