Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Xiaohongshu public-data lookup tool that calls a third-party API with a required token and saves local result logs, with no evidence of hidden execution, exfiltration beyond stated query/API use, or destructive behavior.
Install only if you are comfortable sending Xiaohongshu keywords, profile links, note links, and the provider API token to guaikei.com. Review the local temp logs if the queried topics are sensitive, and treat the package.json batch-download wording as stale or overbroad relative to the inspected code.
根据提供的代码片段，实际功能仅是一个独立的通用参数解析模块（parseArgs/readValueAfterFlag/buildHelp）。它处理命令行选项、别名、默认值、布尔值、数值校验、位置参数冲突、帮助信息生成等。这属于底层工具代码，而不是声明中描述的小红书舆情监测业务逻辑。代码没有显示任何网络请求、爬取/调用小红书数据源、笔记/评论/博主详情处理、情感或舆情分析、报告输出等行为。因此，该代码片段与声明的核心用途存在明显不一致，应判定为描述与行为不匹配。
The declared description describes a full-featured Xiaohongshu monitoring and analytics tool with multiple data collection and analysis capabilities. The supplied code chunk does not implement any of those behaviors. It merely reads the local package.json file to obtain the package name and caches the result. This is an unrelated utility function rather than supporting logic that demonstrates the declared skill behavior, so the description does not accurately represent what this code chunk actually does.
Referenced artifact was not completely inspected
- "这条小红书笔记评论区在吐槽什么 → node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 200"
Referenced artifact was not completely inspected
- "这条小红书笔记评论区在吐槽什么 → node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 200"
Referenced artifact was not completely inspected
- "这条小红书笔记评论区在吐槽什么 → node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 200"
Referenced artifact was not completely inspected
- "这条小红书笔记评论区在吐槽什么 → node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 200"
Referenced artifact was not completely inspected
- "这条小红书笔记评论区在吐槽什么 → node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 200"
Referenced artifact was not completely inspected
- "看这个小红书博主最近 30 条作品发什么 → node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 30"
Referenced artifact was not completely inspected
- "看这个小红书博主最近 30 条作品发什么 → node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 30"
Referenced artifact was not completely inspected
- "看这个小红书博主最近 30 条作品发什么 → node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 30"
Referenced artifact was not completely inspected
- "看这个小红书博主最近 30 条作品发什么 → node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 30"
Referenced artifact was not completely inspected
- "分析这篇小红书爆款笔记为什么火 → node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy'"
Referenced artifact was not completely inspected
- "分析这篇小红书爆款笔记为什么火 → node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy'"
Referenced artifact was not completely inspected
- "分析这篇小红书爆款笔记为什么火 → node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy'"
Referenced artifact was not completely inspected
- "分析这篇小红书爆款笔记为什么火 → node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy'"
Referenced artifact was not completely inspected
- "分析这篇小红书爆款笔记为什么火 → node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy'"
The skill declares access to an environment variable (GUAIKEI_API_TOKEN) but does not define an explicit tool/permission scope. That creates ambiguity about what the skill is allowed to access and makes review and containment harder, especially in agent runtimes that rely on declared scopes for policy enforcement.
The trigger rules are broad enough that the skill may activate for many generic Xiaohongshu-related requests, causing unnecessary transmission of user queries or links to the external API. Over-broad invocation increases privacy and consent risk because users may not realize a third party is being contacted for routine discussion or loosely related requests.
The skill mentions use of guaikei.com and a token, but it does not prominently warn users that their search keywords, links, and retrieved public-content queries are sent to a third-party API. This is dangerous because users may disclose sensitive business research targets, account URLs, or monitoring subjects without informed consent about external data sharing.
The package description advertises bulk downloading of Xiaohongshu content to local storage, which materially exceeds the analytics and sentiment-monitoring scope described in the skill metadata. This scope mismatch can mislead users and orchestrators into invoking a tool with content-harvesting behavior, increasing the risk of unauthorized collection, retention, and redistribution of third-party data.
Bulk local download capability is not necessary for basic sentiment monitoring and therefore expands the data-handling surface without clear justification. In this context, it can enable mass collection of notes, media, and related metadata beyond what is needed for analysis, increasing privacy, compliance, and abuse risks.
This manifest description says the skill takes keywords and profile links, automatically fetches notes, parses download links, and supports one-click batch local downloads, but it does not define when the skill should be invoked versus when it should not. For a manifest-scoped description, the activation scope is underspecified and could match broad data collection or download requests beyond a narrow trigger context.
The user-facing description and keywords are entirely in Chinese and centered on a specific Chinese platform, but the manifest does not state that the skill is region-specific or that language is user-selectable. This can violate language/locale policy when a skill implicitly forces one language without opt-in or justification.
The README instructs users to '直接说人话' and provides only a Chinese example utterance for interacting with the agent. This creates a language-specific expectation without documenting any user choice or alternative locale support, which can violate language/locale policy requirements.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
| --------------- | ------------------------ | --------------------------------------------------------------------------------- |
| `--url`, `-u` | 小红书博主主页链接，必填 | 建议使用主页链接或可解析的短链 |
| `--limit`, `-l` | 返回作品数量上限 | 建议显式传入 `0-10000`；若为0，则获取该博主的互动数据（粉丝量、点赞量、收藏量等） |
| `--help`, `-h` | 显示帮助信息 | 无 |
### 4.4 链接建议
Detected: suspicious.exposed_secret_literal