Security audit
Security checks for vulnerabilities and agentic risk
This skill is a Xiaohongshu trend-analysis helper with mock-data scripts and expected local export/report writes, with no evidence of hidden access, persistence, exfiltration, or destructive behavior.
Install only if you want Xiaohongshu-specific trend-analysis helpers. Treat the included scripts as mock/demo tooling, and avoid pointing export or report outputs at files you do not want replaced because overwrite confirmation is not implemented.
The activation description says to use the skill when users mention broad terms like "creative inspiration" or "traffic trends," plus "etc.," without clear boundaries or exclusion conditions. This is ambiguous and may cause unintended invocation for general brainstorming or analytics requests not specifically about Xiaohongshu viral-post analysis.
This code opens the provided output path for writing, which can silently overwrite an existing file, but there is no prior confirmation prompt or explicit warning before the write occurs. Because the script performs a user-data-affecting file write to an arbitrary path, it should disclose that behavior before execution.
The JSON export function performs a file write to a user-supplied path and provides only a success message after the operation completes. There is no advance disclosure or confirmation that the action may overwrite an existing file.
Saving the workbook is a filesystem-modifying operation that may replace an existing file, yet the script only reports success after the save. Users are not warned beforehand that the export writes to disk at the chosen location.
The usage text and function arguments indicate support for querying by --author_id and by a day window, and query_notes also accepts author_id and days parameters. However, the implementation only filters by category, minimum engagement, and low_fan viral type; it never uses author_id or days when selecting results, so the documented behavior contradicts the actual code.
The docstring and CLI expose viral types low_fan, period_spike, daily_spike, and continuous, implying those query modes are supported. In practice, only low_fan is handled in the filtering logic, so the documentation and interface overstate what the code actually does.
The file is titled specifically for 'Xiaohongshu', a Chinese platform, and the entire criteria set is framed as universally applicable to that locale/platform without stating that it is region-specific guidance or offering any alternative locale choice. Under the policy rule, locale-specific constraints should be explicitly justified when they are imposed.
No suspicious patterns detected.
