other
Error
- Location
scripts/fetch_xiaohongshu.py:12- Finding
Synthetic Fixture Data Misrepresented as Scraped Platform Feedback
- Content
View full analysis
Vulnerability Details
File Locations:
SKILL.md:98-103scripts/fetch_xiaohongshu.py:12-73scripts/fetch_douyin.py:11-72scripts/fetch_weibo.py:11-82scripts/fetch_wechat_video.py:11-72scripts/fetch_ecommerce_reviews.py:11-82
Vulnerability Type: Data provenance and research-integrity failure
Risk Level: HighThe Skill documentation requires collection of 3,000–5,000 raw records and at least 2,000 cleaned, valid user-demand records. However, the platform fetchers do not perform network requests, browser automation, or official API calls. They instead repeat small collections of hard-coded records and save them as if they were recently collected platform data.
Complete Code Snippets
From
scripts/fetch_xiaohongshu.py:12-73:python def fetch_comments(self, keyword: str, limit: int = 100) -> List[Dict]: comments = [] sample_comments = [ { "platform": "小红书", "keyword": keyword, "content": "这个公益项目真的很有意义，希望能帮助到更多需要帮助的人", "author": "用户A", "timestamp": datetime.now().isoformat(), "likes": 156, "sentiment": "positive", "is_negative": False }, { "platform": "小红书", "keyword": keyword, "content": "参与了这个公益活动，但是流程太复杂了，希望能简化一下", "author": "用户B", "timestamp": datetime.now().isoformat(), "likes": 89, "sentiment": "negative", "is_negative": True }, { "platform": "小红书", "keyword": keyword, "content": "捐赠的物资不知道去向，希望能有更透明的公示机制", "author": "用户C", "timestamp": datetime.now().isoformat(), "likes": 234, "sentiment": "negative", "is_negative": True }, { "platform": "小红书", "keyword": keyword, "content": "客服响应太慢了，咨询了好几天都没有回复", "author": "用户D", ...[truncated 5440 chars]- Remediation
View remediation
Remediation Suggestions
- Rename and clearly label the current implementations as mock or demonstration generators.
- Prevent mock fetchers from running in production workflows or contributing to empirical reports.
- Add an explicit field such as
synthetic: trueto every fixture and propagate that status through cleaning, analysis, and reporting. - Implement compliant collection adapters using official APIs or authorized browser-based retrieval where legally and contractually permitted.
- Record verifiable provenance for every retrieved item, including a source URL or immutable platform identifier, retrieval time, and adapter version.
- Reject records that lack provenance when a report is designated as real-world research.
- Enforce minimum thresholds based on unique, provenance-verified records rather than generated record counts.
- Make report generation fail closed when the documented sample threshold is not met.
- Validate that engagement values and timestamps originate from source records rather than being generated locally.
- Add automated tests proving that production adapters perform actual retrieval and cannot silently fall back to fixtures.
- Clearly disclose collection limitations, platform coverage, duplicate rates, and synthetic-data use in every generated report.
- Reconcile the documented 2,000-record requirement with the actual capacity of the collection pipeline before presenting statistical-confidence claims.