Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Xiaohongshu public-data lookup tool that uses a paid API token and saves local result logs, with no evidence of hidden execution, account access, or destructive behavior.
Install only if you are comfortable sending Xiaohongshu keywords or links and your GUAIKEI_API_TOKEN to guaikei.com. Treat returned comments and profile metrics as public social-media data: use them for lawful internal analysis, avoid redistributing personal data, and remember that result JSON is automatically saved in a local temp log directory.
声明描述的是一个面向小红书公开数据分析的业务技能，核心应涉及网络请求、数据抓取、内容/互动数据处理或分析逻辑。但提供的代码片段仅包含 args.js 中的通用命令行参数解析器：读取 flag 值、校验数字、处理布尔参数、位置参数冲突告警、必填检查，以及根据 schema 生成帮助文本。该代码既不访问小红书，也不处理任何笔记、博主、评论或市场分析数据。由于实际行为与声明的主要功能完全不一致，这属于明显的描述-行为不匹配。
The declared description promises a full-featured Xiaohongshu data collection and analysis skill for market research. However, the supplied code chunk does not implement any of those capabilities. It merely reads a local package.json file from disk and returns the package name. This is a materially different purpose from the declared functionality. While this could be a small utility within a larger skill, based on the supplied chunk alone it does not match the described behavior, so this should be flagged as a mismatch.
Referenced artifact was not completely inspected
- "这条小红书笔记评论区在吐槽什么 → node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 200"
Referenced artifact was not completely inspected
- "这条小红书笔记评论区在吐槽什么 → node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 200"
Referenced artifact was not completely inspected
- "这条小红书笔记评论区在吐槽什么 → node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 200"
Referenced artifact was not completely inspected
- "这条小红书笔记评论区在吐槽什么 → node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 200"
Referenced artifact was not completely inspected
- "这条小红书笔记评论区在吐槽什么 → node src/xiaohongshu/comment-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 200"
Referenced artifact was not completely inspected
- "看这个小红书博主最近 30 条作品发什么 → node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 30"
Referenced artifact was not completely inspected
- "看这个小红书博主最近 30 条作品发什么 → node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 30"
Referenced artifact was not completely inspected
- "看这个小红书博主最近 30 条作品发什么 → node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 30"
Referenced artifact was not completely inspected
- "看这个小红书博主最近 30 条作品发什么 → node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 30"
Referenced artifact was not completely inspected
- "分析这篇小红书爆款笔记为什么火 → node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy'"
Referenced artifact was not completely inspected
- "分析这篇小红书爆款笔记为什么火 → node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy'"
Referenced artifact was not completely inspected
- "分析这篇小红书爆款笔记为什么火 → node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy'"
Referenced artifact was not completely inspected
- "分析这篇小红书爆款笔记为什么火 → node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy'"
Referenced artifact was not completely inspected
- "分析这篇小红书爆款笔记为什么火 → node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy'"
The skill requires access to an environment variable (GUAIKEI_API_TOKEN) but does not declare an explicit tool scope such as permissions or allowed-tools. That weakens least-privilege controls and can let the runtime expose more capability than users or hosting platforms expect, especially across different agent platforms listed in the metadata.
The activation guidance includes broad triggers such as general references to Xiaohongshu plus common tasks like checking data or market research. Overbroad invocation criteria can cause the agent to run the skill unexpectedly, sending user-supplied keywords or links to an external API and consuming credentials or quota without sufficiently specific consent.
The README instructs users to invoke the skill by '直接说人话' and gives only a Chinese example phrase, while the entire usage guidance is Chinese-only. For a generally advertised AI skill intended for multiple agent platforms, this implies a fixed language/locale expectation without documenting user choice or a justified regional limitation.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
| --------------- | ------------------------ | --------------------------------------------------------------------------------- |
| `--url`, `-u` | 小红书博主主页链接，必填 | 建议使用主页链接或可解析的短链 |
| `--limit`, `-l` | 返回作品数量上限 | 建议显式传入 `0-10000`；若为0，则获取该博主的互动数据（粉丝量、点赞量、收藏量等） |
| `--help`, `-h` | 显示帮助信息 | 无 |
### 4.4 链接建议
The document explicitly supports collecting comment content and account interaction data for analysis, but it provides no warning about privacy expectations, lawful basis, platform terms, retention, or downstream handling of potentially personal data. In a data-collection skill, that omission can normalize non-compliant scraping or secondary use of user-generated content, increasing legal, privacy, and governance risk.
Multiple error messages returned by this utility are written only in Chinese, such as "请求失败", "响应解析失败", and "token 必须是非空字符串". This imposes a fixed locale on users and callers with no indication of language selection, fallback, or documented locale constraint.
The code sends JSON payloads and query parameters over HTTPS and includes a TOKEN header, but there is no confirmation prompt, visible user-facing log, or warning comment/docstring in this file indicating that user or system data may be transmitted to an external service. Because this is a generic request utility rather than an obviously user-facing deploy/send feature, the disclosure is not clearly implied by the code alone.
This code emits all natural-language error messages in Chinese, which imposes a specific language on users. Under the policy, forcing a language without user opt-in or clear justification is a natural-language policy violation.
The CLI writes fetched comment results to a local JSON file automatically, but the user-facing flow does not clearly disclose this persistence or ask for consent. Because the data being handled includes scraped comment content and metadata from public social posts, silent local retention can create privacy, compliance, and data-handling risks, especially on shared systems or in automated pipelines where output files may be overlooked and later exposed.
Detected: suspicious.exposed_secret_literal