Most static shell, obfuscation, and path traversal findings are false positives caused by JavaScript template literals, ANSI escape sequences, imports, Markdown fences, and ellipsis text. Confirmed risks are a command skill that reads GUAIKEI_API_TOKEN, sends it to www.guaikei.com in URL query parameters, performs HTTPS requests, and writes local lock and result files. No prompt injection or confirmed malicious intent was found, but publication should warn users about third-party token transmission and local output files.
The script reads GUAIKEI_API_TOKEN and the request builder places token in query parameters for both create and result requests to www.guaikei.com. This appears intended for API access, but query-string tokens can be captured in service logs, proxies, and error traces.
The data flow is direct: the environment token is read and then serialized into request query parameters. Confidence is below very high because the token is for the same third-party API the skill is designed to call.
The command creates lock files from the sanitized keyword and writes last-search.json under the scripts directory. Sanitization removes path separators, so path traversal was not confirmed, but persisted search results may expose user research on shared machines.
The file writes are explicit and use user-derived keyword data. The impact is moderate because paths are constrained to the script directory and slash characters are removed during sanitization.
The documentation says all output data is desensitized and has no personal information, but the code can output author nicknames and profile URLs returned by the API. This is a marketplace content and privacy expectation issue rather than hidden exfiltration.
The mismatch is clear from the documentation and output formatting code. The risk is limited because the skill appears to process public Xiaohongshu data returned by its API provider.
When GUAIKEI_API_TOKEN is missing or invalid, the key module returns a fixed default token. The weak-cryptography static finding is a false positive, but a shared fallback token can create rate-limit, attribution, and reliability issues.
The fallback token behavior is visible in the code. It is not cryptographic use, so the security impact is lower than the static scanner suggested.
No evidence of shell execution, eval, subprocess spawning, or prompt injection was found in reviewed files. The scanner matched JavaScript template literals, ANSI color escape sequences, relative imports, Markdown code fences, Unicode ranges, and ellipsis text.
The reviewed locations contain formatting, imports, or documentation examples rather than executable shell commands or encoded payloads. No untrusted instruction text attempts to override the audit.