Security audit

xhs-user-search

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Xiaohongshu public-data collection tool that uses a third-party API token and saves results locally, with some documentation mismatch but no artifact-backed hidden or destructive behavior.

Before installing, confirm you are comfortable sending Xiaohongshu keywords or URLs to the Guaikei API using your GUAIKEI_API_TOKEN, and remember that returned public data can be saved in the skill's logs directory. Review the broader capability set, not only the one-line description.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill requires and uses an environment variable (`GUAIKEI_API_TOKEN`) but does not explicitly declare a permission model for secret/environment access beyond metadata hints. This creates a transparency and governance gap: users may not understand that a secret will be consumed and sent to a third-party API, making review, policy enforcement, and least-privilege controls harder.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The documented skill purpose is narrowly framed as comment collection for a specific note, but the file describes broader capabilities: keyword search, creator/profile monitoring, local logging, and transmission of user inputs plus API token to a third-party service. This mismatch is dangerous because it can mislead reviewers and users about the true data flows and operational scope, reducing informed consent and increasing the risk of unintended data disclosure or policy violations.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The changelog advertises capabilities far beyond the stated skill purpose, including keyword search, note detail extraction, user work monitoring, competitor analysis, KOL screening, and trend monitoring. This creates a scope-transparency and governance problem: users or integrators may grant access, rely on policy review, or deploy the skill under the assumption it only collects public comments, while the implementation or future updates may perform broader scraping and profiling than expected.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The documentation materially expands the skill from a single-note comment collector into three broader Xiaohongshu collection capabilities: keyword search, note-detail/comment extraction, and creator post scraping. This creates a scope mismatch between the manifest and actual documented behavior, which can mislead reviewers, policy enforcement, and end users about what data collection the skill supports.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: The implementation and comments clearly target blogger/profile post retrieval (`/api/xiaohongshu/post/...`) rather than the manifest-described function of collecting comments from a specific note. This capability mismatch is dangerous because it can cause the agent to access and return a materially different dataset than users authorized or expected, undermining transparency, consent, and downstream policy controls.

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The inline documentation repeatedly describes blogger URLs and published-note retrieval, directly contradicting the skill's stated purpose of harvesting public comments for a note. Such contradictions are a security-relevant integrity issue because reviewers, users, and guardrails may approve one capability while the code implements another, enabling unintended data collection or deceptive behavior.

Description-Behavior Mismatch

High

Confidence: 94% confidence
Finding: The implemented CLI behavior does not match the stated skill description: it collects a user's profile posts from a blogger homepage URL rather than comments for a specific note. This scope mismatch is dangerous because operators may authorize or run the skill under false assumptions about what data is being collected, creating undisclosed data access and trust-boundary violations.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The CLI writes the full fetched result set to a local JSON file without this persistence being disclosed in the skill description. Even if the source data is public, local retention of structured scraped data increases privacy, compliance, and unintended exposure risk because the data remains on disk after execution.

Description-Behavior Mismatch

Medium

Confidence: 85% confidence
Finding: The skill writes returned search results to a local JSON file without making that persistence clear in the declared behavior. Even if the data is publicly sourced, storing query results and associated metadata locally can create unintended retention of potentially sensitive user interests, collected profile data, or operational traces on shared systems.

Missing User Warnings

Low

Confidence: 81% confidence
Finding: The README states that all task results are automatically saved under logs/ but does not warn that harvested comments, nicknames, links, or other third-party content may be persisted locally. In a data-collection skill, silent retention increases the risk of unintended disclosure, over-retention, or downstream mishandling of scraped content, especially on shared systems or when logs are later exported.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The file instructs users to configure a third-party API token and invoke external platform capabilities, but does not clearly disclose that supplied queries, URLs, and retrieved Xiaohongshu data may be transmitted to an external service. This is dangerous because users may unknowingly send sensitive business research targets or collected social-platform data to a third party without informed consent or governance review.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The code transmits a user-supplied profile URL together with authenticated remote task requests, but the CLI does not present an explicit notice that user input will be sent to an external service. This is risky because users may believe processing is local based on the skill framing, leading to undisclosed third-party data sharing and possible privacy/compliance issues.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: Search results are silently persisted to disk after execution, with no user confirmation or warning. In CLI and agent contexts, undisclosed local writes can leak collected data to other users on the host, leave forensic traces, and violate user expectations about transient processing.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.