小红书运营分析助手

• Outcome: Review
• Latest audit: Sep 17, 2026 · 5:52 AM UTC
• Version: 1.1.4

Overview

This skill coherently fetches public Xiaohongshu data through a disclosed third-party API and does not show hidden, destructive, or deceptive behavior.

Install only if you are comfortable using guaikei.com as the data provider and storing its API token in your environment. Treat retrieved comments, profile metrics, and local JSON logs as potentially sensitive business or user-generated content; use only public data, follow Xiaohongshu and applicable privacy rules, and delete local logs when they are no longer needed.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (46)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: This code chunk does not perform any of the domain-specific functions described in the skill declaration. It contains only utility functions for parsing command-line arguments and generating help text. While such a utility could be a supporting component inside a larger Xiaohongshu tool, the supplied chunk itself does not reflect the declared purpose and instead has a materially different immediate behavior: generic CLI argument handling. Therefore, this chunk is mismatched against the declared description.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: Yes, this is a clear mismatch. The declared description promises a full Xiaohongshu operations and analytics tool, but the supplied code chunk only implements a utility that reads package.json from disk and returns the package name. That behavior is merely internal metadata access and does not substantively represent the declared product capabilities. While helper utilities are normal, this chunk by itself does not align with the described purpose and instead performs an unrelated filesystem read.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: 描述将该技能表述为覆盖多种小红书运营分析场景的一站式工具，但这段代码的实际功能明显更窄：它只是针对单个小红书笔记链接抓取/查询详情任务结果的 CLI。代码中没有任何与选题、标题生成、粉丝画像、竞品监控、KOL 筛选或舆情分析相关的实现，也没有关键词检索入口；唯一输入是 --url/笔记链接。此外，它要求配置 GUAIKEI_API_TOKEN。虽然这不等同于必须登录小红书账号，但与描述中“给关键词或链接即可”的广泛能力相比，当前代码片段的实际主用途要狭窄得多，因此构成明显描述-行为不匹配。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence
• Finding: 该代码块的核心功能仅是基于关键词的小红书内容搜索与结果输出，属于“数据获取”中的一个子能力。声明描述却覆盖了大量更广泛的运营分析与生成能力，如标题生成、粉丝分析、竞品监控、KOL筛选、评论舆情分析等，这些在代码中都没有体现。此外，描述称“给关键词或链接即可”，但此代码只接受关键词参数，没有链接处理逻辑。虽然代码确实与小红书数据检索相关，且不要求用户显式登录账号，但它需要配置 API token，因此与宣称的整体能力范围相比明显更窄，构成描述与实际行为不匹配。

Ae1

High

• Category: analysis-evasion

Content

- "这条小红书笔记评论区在吐槽什么 → node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 200"

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

- "这条小红书笔记评论区在吐槽什么 → node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 200"

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

- "这条小红书笔记评论区在吐槽什么 → node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 200"

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

- "这条小红书笔记评论区在吐槽什么 → node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 200"

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

- "这条小红书笔记评论区在吐槽什么 → node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 200"

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

- "看这个小红书博主最近 30 条作品发什么 → node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 30"

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

- "看这个小红书博主最近 30 条作品发什么 → node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 30"

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

- "看这个小红书博主最近 30 条作品发什么 → node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 30"

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

- "看这个小红书博主最近 30 条作品发什么 → node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 30"

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

- "分析这篇小红书爆款笔记为什么火 → node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy'"

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

- "分析这篇小红书爆款笔记为什么火 → node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy'"

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

- "分析这篇小红书爆款笔记为什么火 → node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy'"

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

- "分析这篇小红书爆款笔记为什么火 → node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy'"

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

- "分析这篇小红书爆款笔记为什么火 → node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy'"

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The activation guidance is very broad and can trigger on generic Xiaohongshu-related requests such as '帮我看看 XX 在小红书上的情况,' causing the agent to invoke an external data-access skill without sufficiently specific user intent or parameter confirmation. In an agent ecosystem, overbroad routing increases the chance of unnecessary third-party data disclosure, incorrect tool use, and surprise external calls based on ambiguous prompts.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The README instructs users to '直接说人话' and provides only a Chinese invocation example, while the entire skill description is presented exclusively in Chinese. This creates a locale/language constraint without any explicit opt-in or alternative language support, which can violate natural-language policy requirements for language choice.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The documentation explicitly supports collecting public profile interaction metrics and note comments, but it does not warn users about privacy, consent, platform ToS, or downstream handling of scraped personal/content data. In a social-media data collection skill, this omission increases the risk of inappropriate collection, analysis, or retention of user-generated content and profile-related data.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

| --------------- | ------------------------ | --------------------------------------------------------------------------------- |
| `--url`, `-u`   | 小红书博主主页链接，必填 | 建议使用主页链接或可解析的短链                                                    |
| `--limit`, `-l` | 返回作品数量上限         | 建议显式传入 `0-10000`；若为0，则获取该博主的互动数据（粉丝量、点赞量、收藏量等） |
| `--help`, `-h`  | 显示帮助信息             | 无                                                                                |

### 4.4 链接建议

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: This markdown file uses only Chinese for operational troubleshooting guidance, support information, and usage details. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is explicitly justified, which is not stated here.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This code performs outbound HTTPS GET and POST requests, sends request payloads, and includes a TOKEN header, but there is no confirmation prompt, user-facing log/message, or inline warning indicating that user/system data and credentials may be transmitted to an external service. For code files, such undisclosed network transmission is in scope when there is no visible disclosure and the warning is not evident in the file itself.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:16