Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Xiaohongshu public-data lookup tool that sends user-provided keywords or links to a third-party API and stores local result logs.
Install this only if you are comfortable using guaikei.com as a third-party Xiaohongshu data provider. Your API token and the keywords or Xiaohongshu links you query will be sent to that service, and returned results are saved locally in temp logs.
代码文件 src/utils/args.js 仅实现了 readValueAfterFlag、parseArgs 和 buildHelp 三个通用工具函数，用于处理命令行参数和生成帮助信息。它没有网络请求、页面抓取、API 调用、数据提取、评论分析、情绪分析或任何与小红书平台相关的逻辑。因此，这段代码的实际行为与声明描述的核心用途明显不一致。虽然它可能是某个更大技能中的辅助模块，但就所提供代码块本身而言，其功能是基础 CLI 支撑组件，而不是所宣称的数据采集与分析能力。
声明描述的是一个面向小红书数据抓取与分析的完整技能，但提供的代码片段只是一个本地工具函数，用于读取 package.json 中的 name 字段并做缓存。该代码没有网络请求、没有解析小红书链接、没有搜索/筛选/排序逻辑、没有评论或互动数据处理，也没有任何用户洞察或情绪分析能力。虽然读取包名可能是内部支持性实现，但就当前提供的代码片段而言，其行为与声明的核心用途严重不一致，因此应判定为描述与代码行为不匹配。
Referenced artifact was not completely inspected
- "这条小红书笔记评论区在吐槽什么 → node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 200"
Referenced artifact was not completely inspected
- "这条小红书笔记评论区在吐槽什么 → node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 200"
Referenced artifact was not completely inspected
- "这条小红书笔记评论区在吐槽什么 → node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 200"
Referenced artifact was not completely inspected
- "这条小红书笔记评论区在吐槽什么 → node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 200"
Referenced artifact was not completely inspected
- "这条小红书笔记评论区在吐槽什么 → node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 200"
Referenced artifact was not completely inspected
- "看这个小红书博主最近 30 条作品发什么 → node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 30"
Referenced artifact was not completely inspected
- "看这个小红书博主最近 30 条作品发什么 → node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 30"
Referenced artifact was not completely inspected
- "看这个小红书博主最近 30 条作品发什么 → node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 30"
Referenced artifact was not completely inspected
- "看这个小红书博主最近 30 条作品发什么 → node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 30"
Referenced artifact was not completely inspected
- "分析这篇小红书爆款笔记为什么火 → node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy'"
Referenced artifact was not completely inspected
- "分析这篇小红书爆款笔记为什么火 → node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy'"
Referenced artifact was not completely inspected
- "分析这篇小红书爆款笔记为什么火 → node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy'"
Referenced artifact was not completely inspected
- "分析这篇小红书爆款笔记为什么火 → node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy'"
Referenced artifact was not completely inspected
- "分析这篇小红书爆款笔记为什么火 → node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy'"
Without declared permissions the skill's intent is opaque and cannot be validated.
The invocation trigger is broad enough to match many generic research, product-analysis, and market-monitoring requests whenever users mention 小红书/xhs/rednote. Over-broad routing can cause the agent to invoke this skill unexpectedly, exposing user prompts, links, or query targets to an external API-backed integration and increasing the chance of unintended data sharing or misuse.
The example phrase '帮我看看 XX 在小红书上的情况' is ambiguous and lacks clear boundaries for what qualifies as appropriate invocation. Ambiguous triggers make unintended activation more likely, which can route sensitive or loosely related requests through a third-party data service without sufficiently specific user consent or targeting.
The natural-language metadata is entirely in Chinese, including the package description and keywords, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking or China-specific context. This can violate language or locale policy when a skill appears to require a specific language without opt-in or explicit justification.
The README instructs users to interact with the agent using a Chinese natural-language example ('然后直接说人话：『帮我找最近一周小红书露营装备的高赞笔记』') and the document is entirely presented in Chinese, without indicating that other languages are supported. This can be read as a locale/language expectation without user opt-in, which matches the language-policy concern for natural-language policy violations.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
| --------------- | ------------------------ | --------------------------------------------------------------------------------- |
| `--url`, `-u` | 小红书博主主页链接，必填 | 建议使用主页链接或可解析的短链 |
| `--limit`, `-l` | 返回作品数量上限 | 建议显式传入 `0-10000`；若为0，则获取该博主的互动数据（粉丝量、点赞量、收藏量等） |
| `--help`, `-h` | 显示帮助信息 | 无 |
### 4.4 链接建议
这是一个 markdown 文件，适用 SQP-2 的文档告警标准。文档要求配置 GUAIKEI_API_TOKEN 并执行多个针对小红书内容、博主信息和评论数据的查询能力，明显涉及对外部服务的网络访问，但未明确提醒会向第三方服务发送查询关键词、链接或相关请求数据。
The troubleshooting guide is written entirely in Chinese, including operational guidance and support instructions, with no indication that users may choose another language. This can violate a language/locale policy when a skill imposes a specific language without user opt-in or documented justification.
The comments, JSDoc, and user-facing retry/error strings are entirely in Chinese, including messages likely surfaced during execution. This imposes a specific language/locale without any visible opt-in or documented region-specific justification in the file.
Detected: suspicious.exposed_secret_literal