Security audit

xiaohongshu-tool

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Xiaohongshu public-data research tool, with expected API-token use, network access, and local result saving.

Install only if you are comfortable using the Guaikei third-party API and storing fetched Xiaohongshu public-data results locally. Keep GUAIKEI_API_TOKEN scoped to this service, avoid private or sensitive URLs, and clean the logs directory when retained research data is no longer needed.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill declares and depends on the sensitive environment variable `GUAIKEI_API_TOKEN`, but the metadata shown does not include an explicit permissions model describing access to secrets or outbound integration scope. That creates a transparency and least-privilege problem: users and hosts may not clearly understand that the skill can consume a token and send requests to a third-party API service. In this context, the risk is somewhat reduced because the file openly documents the token purpose and limits usage to public-data retrieval, but it is still a real configuration and disclosure weakness.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The CLI persists fetched note detail and comment data to a local JSON file after successful execution. For a tool described primarily as querying public Xiaohongshu content, this creates additional data retention and local exposure risk because note metadata and comments may contain personal or sensitive information, and users are not clearly informed that results will be stored on disk.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The CLI writes the full fetched results to a local JSON file by default, which can persist potentially sensitive operational data longer than the user expects. In shared workstations, CI runners, or multi-user environments, these files may be readable by other users or later exfiltrated, creating an unnecessary data exposure risk.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The CLI persists full search output to a local JSON file after completing the request, but this storage behavior is not apparent from the stated skill purpose or user-facing flow. Even if the data is 'public' Xiaohongshu content, saved results can include user queries and harvested datasets that may create privacy, retention, or operator-side data handling risk when written silently to disk.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The README states that all task results are automatically saved under logs/, but it does not clearly warn users what data may be persisted, how long it remains, or how to protect it. Because this tool collects public post details, comments, links, and analyst query terms, automatic disk persistence can expose sensitive research activity or harvested data to other local users, backups, or later unintended sharing.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The command sends the user-supplied note URL and limit to external APIs through createDetailTask/getDetailTask, but the interface does not clearly warn that these inputs will be transmitted off-host. While network access is expected for this kind of scraper/integration, lack of explicit disclosure can cause unintentional sharing of tracked URLs, tokens embedded in URLs, or usage patterns.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The tool writes the complete task results to a local JSON file without explicit user consent or a clear warning about persistent storage. Even if the source content is public, the stored dataset can include comments, profile references, and timestamps that increase privacy and compliance exposure on the local machine.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The tool silently writes result data to disk without warning in the usage/help output, which can surprise users and create local data retention risks. Because the output may include scraped public-content datasets and analysis artifacts, undisclosed persistence increases the chance of leakage through backups, logs, or shared directories.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: Search results are written to a local file without explicit user warning at execution time or an opt-in control. Silent persistence can surprise users, leave sensitive search terms or collected datasets on shared systems, and increase exposure through later access, backup, or log collection.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.