Security audit

Xiaohongshu Openclaw Skill(1)

Security checks across malware telemetry and agentic risk

Overview

This skill coherently queries public Xiaohongshu data through a disclosed third-party API, but users should be aware that successful results are saved locally.

Install only if you are comfortable sending Xiaohongshu keywords or URLs to Guaikei and having returned public-platform data saved locally under logs. Avoid submitting sensitive campaign plans, private links, secrets, or data you do not want retained in local result files.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The CLI writes retrieved Xiaohongshu results to a local JSON log file even though the skill description emphasizes returning structured data and does not disclose local persistence. This can expose potentially sensitive business intelligence or user-supplied URLs to other local users, backup systems, or downstream tooling without the operator’s clear awareness.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The CLI writes the full search output to a local JSON file using a filename derived from user input, but the skill description frames the capability as fetching structured data rather than persisting it. Silent local retention increases data exposure risk, especially if results contain sensitive business research, monitored competitor data, or user-generated content that operators may not expect to be stored on disk.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The skill description says it should be used even when the user did not explicitly mention operations, as long as the goal is data-driven decision making on Xiaohongshu. This broad trigger condition can cause over-invocation and unnecessary exfiltration of user-provided keywords or URLs to a third-party API, increasing privacy and least-privilege risks.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The README states that all task results are automatically saved to a local logs directory, but it does not clearly warn users that their queried URLs, keywords, and scraped public-platform data may be persistently written to disk. In this skill’s context, those inputs can reveal competitive research targets, campaign plans, monitored accounts, and collected content, creating confidentiality and data-retention risk for users and their organizations.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The documentation requires configuring `GUAIKEI_API_TOKEN` and taking user-supplied keywords or URLs, but it does not clearly disclose that these inputs and credentials will be used to call an external service. This can mislead operators about data flow and trust boundaries, increasing the risk of unintentionally sending sensitive URLs, tracking parameters, or business research queries to a third party.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: This CLI sends a user-supplied Xiaohongshu note URL and retrieves comment data from a remote API, then writes the returned results to a local JSON file without an explicit consent or privacy warning at the point of execution. Even if this is the intended product behavior, it can expose sensitive query targets, collected comments, and execution metadata to third-party services and local disk in environments where users do not expect persistence or transmission.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The tool persists full result data to a local JSON file without user opt-in or a clear warning. Even if the data is publicly sourced, aggregated notes, metadata, and request context can still be sensitive operational data, and silent persistence increases the risk of unintended disclosure through shared machines, logs, or backups.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: Search results are written to a local file without user-facing consent or a clear notice at execution time. This can create unintended data retention and confidentiality issues, particularly in a skill used for market intelligence, where stored outputs may reveal sensitive keywords, strategies, or collected content to other local users or processes.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:16