Security audit

xiaohongshu-zuopinpaqu

Security checks across malware telemetry and agentic risk

Overview

The skill is a disclosed Xiaohongshu public-data lookup tool that sends user-provided search terms or links to a third-party API and saves results locally.

Install only if you are comfortable sending Xiaohongshu keywords, note URLs, profile URLs, and related xsec_token query strings to the Guaikei API, and with returned public-data results being saved locally under logs/. Avoid sensitive internal research terms, confidential target lists, or links containing parameters you are not allowed to share.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The public description frames the skill as a keyword-based Xiaohongshu scraping/search tool, but the documentation reveals broader behavior: fetching note details/comments, monitoring creator posts, writing JSON logs locally, and sending data to a third-party API using `GUAIKEI_API_TOKEN`. This mismatch can mislead users and operators about data flows, persistence, and external dependencies, increasing the risk of unintended data disclosure or use in contexts that did not authorize third-party transmission.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The changelog advertises capabilities beyond the declared skill scope, including note detail/comment sentiment analysis and creator work monitoring. This creates a scope-transparency problem: users, reviewers, or downstream agents may rely on incomplete metadata and unintentionally grant trust or invoke data-collection behaviors that were not clearly disclosed. In a scraping-oriented skill, undisclosed expansion of collection/monitoring features is more dangerous because it can mask higher-risk processing of user/content data.

Description-Behavior Mismatch

Low

Confidence: 84% confidence
Finding: The CLI persists scraped note/comment data to a local JSON file automatically, which can create unintended local retention of potentially sensitive or regulated content. In the skill context, this is more concerning because the manifest emphasizes crawling works/hot posts data but does not disclose local storage of detailed scraped results, reducing user awareness and consent.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The README states that all task results are automatically saved to the logs directory with filenames derived from time plus keywords or links, but it does not warn users that searched keywords, profile URLs, note URLs, or analysis outputs may be persisted locally. This can expose sensitive business research, target account lists, user-supplied URLs containing tracking or access parameters, and scraped content to other local users, backups, or later compromise of the host.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: Fetched note/comment data is written to a local JSON file without visible warning in this file, so users may not realize the tool leaves durable copies on disk. In a scraping skill that handles comment content, silent persistence increases privacy, compliance, and accidental disclosure risk if the host is shared, backed up, or later accessed by other processes.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The CLI sends a user-supplied profile URL to external service endpoints via createPostTask/getPostTask without any explicit privacy notice or consent flow. Even if the URL points to public content, it can contain identifiers and query tokens such as xsec_token, so forwarding it to a third-party backend creates a real data-sharing risk beyond local processing.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The CLI persists full search results to a local JSON file containing the queried keyword and returned content without clearly disclosing that disk write behavior to the user beforehand. This can create unintended local data retention, exposing sensitive queries or scraped content to other local users, backups, or later compromise of the host.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The tool sends the user-provided keyword and search parameters to a remote API service, but the help and normal execution flow do not clearly warn users that their input leaves the local machine. If users enter sensitive topics, internal terms, or personal data, that information is disclosed to a third party without explicit notice, creating a privacy and compliance risk.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.